CVE-2021-46999

Summary

CVE-2021-46999: A vulnerability in the Linux kernel's sctp (Stream Control Transmission Protocol) component has been addressed. This issue involves a use-after-free condition where an old association (asoc) is utilized to send COOKIE-ACK and SHUTDOWN chunks that were allocated to the new asoc. Consequently, an access violation occurs when the old asoc, which has already been freed, is referenced in the function sctp_sf_t2_timer_expire(). The patch resolves this issue by updating the asoc before allocating the chunks, thus preventing the transmission of chunks from one asoc to another.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.