[oss-security] CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem

Description of the problem:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in
sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a
new association would be created in sctp_unpack_cookie(), but
afterwards, some processing maybe failed, and sctp_association_free()
will be called to free the previously allocated association, in
sctp_association_free(), sk_ack_backlog value is decremented for this
socket, since the initial value for sk_ack_backlog is 0, after
the decrement, it will be 65535, a wrap-around problem happens, and
if we want to establish new associations afterward in the same
socket, ABORT would be triggered since sctp deem the accept queue as
full.

A remote attacker can block further connection to the particular sctp
server socket by sending a specially crafted sctp packet.

Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d3217b15a19a4779c39b212358a5c71d725822ee

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1113967

Thanks,
– Petr Matousek / Red Hat Product Security PGP: 0xC44977CA 8107 AF16 A416 F9AF 18F3 D874 3E78 6F42 C449 77CA