CVE-2022-50243

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel's SCTP implementation. Specifically, the vulnerability occurs when handling errors returned from the sctp auth asoc init active key() function. If this function returns an error, the active key is not updated correctly, leading to a potential use-after-free when sending packets. The issue was identified by syzbot and involves the sctp auth shkey hold() function within net/sctp/auth.c, as well as sctp sendmsg to asoc() in net/sctp/socket.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.