PT-2026-60561 · Omnios+3 · Omnios+2
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red |
Name of the Vulnerable Software and Affected Versions
illumos distributions prior to illumos-gate commit 53a3efde
Description
The SCTP inbound path performs association lookup for INIT ACK chunks without properly validating the address parameters within the chunk. Because this process occurs during packet classification, before SCTP integrity checks or IPsec policies are applied, a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters. This can trigger an out-of-bounds access and kernel heap corruption, potentially resulting in remote code execution.
Recommendations
Update illumos distributions to illumos-gate commit 53a3efde or later.
Exploit
Fix
Heap Based Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Omnios
Smartos
Illumos-Gate