VulnerabilityModified

CVE-2014-0101

HIGH 7.8EPSS 7.18%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

CVSS 2.0: 7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS: 7.18% probability · 94th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-476
Affected: linux/linux kernel · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server tus · redhat/enterprise linux workstation · canonical/ubuntu linux · f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip edge gateway · f5/big-ip enterprise manager · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/big-ip protocol security module · +7 more
Source: secalert@redhat.com

EPSS trend

EPSS 7.2% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec0223ec48a90cb605244b45f7c62de856403729
http://rhn.redhat.com/errata/RHSA-2014-0328.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0419.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0432.htmlThird Party Advisory
http://secunia.com/advisories/59216Third Party Advisory
http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/03/04/6Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/65943Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2173-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2174-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1070705Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729Patch, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec0223ec48a90cb605244b45f7c62de856403729
http://rhn.redhat.com/errata/RHSA-2014-0328.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0419.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0432.htmlThird Party Advisory
http://secunia.com/advisories/59216Third Party Advisory
http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/03/04/6Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/65943Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2173-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2174-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1070705Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729Patch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.