CVE-2008-3526 Integer overflow in n/a
Remote attackers can cause a kernel panic and denial of service via a crafted SCTP authentication key length field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-3526?
CVE-2008-3526 is a high-severity vulnerability in Linux kernel, published on 27 Aug 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.
Weakness: CWE-189
Which versions are affected by CVE-2008-3526?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2008-3526?
Apply the vendor's patch.
Is CVE-2008-3526 being exploited?
There is no known exploitation of CVE-2008-3526 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-qxv8-g8q7-36cp.