Linux Kernel SCTP Association Migration Race Condition Vulnerability

A race condition vulnerability has been identified in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. This issue arises in the 'sctp_wait_for_connect' function, which drops and re-acquires the socket lock while waiting for an association to reach the ESTABLISHED state. During this period, another thread can peel off the association to a new socket using the 'getsockopt(SCTP_SOCKOPT_PEELOFF)' option, inadvertently changing the association's socket reference. When the original socket lock is re-acquired, 'sctp_wait_for_connect' erroneously reports success without recognizing the migration. This oversight can lead to the association being accessed under the wrong lock in the 'sctp_datamsg_from_user' function, potentially causing data corruption or other unintended behavior.

Impact

This vulnerability can cause a race condition that leads to accessing an SCTP association under the wrong socket lock, which can disrupt the proper handling of data messages and potentially cause data corruption.

Reproduction

The vulnerability can be reproduced by creating a scenario where one thread calls 'sctp_wait_for_connect' and another thread simultaneously peels off the association to a new socket. This can be done by using the 'getsockopt' function with the 'SCTP_SOCKOPT_PEELOFF' option while the first thread is still holding the socket lock, causing the association to migrate without proper synchronization.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability. The specific commits that fix this issue can be downloaded as part of the Linux kernel source.