{"id":"CVE-2021-46999","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: do asoc update earlier in sctp_sf_do_dupcook_a\n\nThere's a panic that occurs in a few of envs, the call trace is as below:\n\n  [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI\n  [] RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0x1fa [sctp]\n  []  sctp_assoc_control_transport+0x1b9/0x210 [sctp]\n  []  sctp_do_8_2_transport_strike.isra.16+0x15c/0x220 [sctp]\n  []  sctp_cmd_interpreter.isra.21+0x1231/0x1a10 [sctp]\n  []  sctp_do_sm+0xc3/0x2a0 [sctp]\n  []  sctp_generate_timeout_event+0x81/0xf0 [sctp]\n\nThis is caused by a transport use-after-free issue. When processing a\nduplicate COOKIE-ECHO chunk in sctp_sf_do_dupcook_a(), both COOKIE-ACK\nand SHUTDOWN chunks are allocated with the transort from the new asoc.\nHowever, later in the sideeffect machine, the old asoc is used to send\nthem out and old asoc's shutdown_last_sent_to is set to the transport\nthat SHUTDOWN chunk attached to in sctp_cmd_setup_t2(), which actually\nbelongs to the new asoc. After the new_asoc is freed and the old asoc\nT2 timeout, the old asoc's shutdown_last_sent_to that is already freed\nwould be accessed in sctp_sf_t2_timer_expire().\n\nThanks Alexander and Jere for helping dig into this issue.\n\nTo fix it, this patch is to do the asoc update first, then allocate\nthe COOKIE-ACK and SHUTDOWN chunks with the 'updated' old asoc. This\nwould make more sense, as a chunk from an asoc shouldn't be sent out\nwith another asoc. We had fixed quite a few issues caused by this.","modified":"2026-03-15T22:43:05.810753Z","published":"2024-02-28T09:15:38.130Z","references":[{"type":"FIX","url":"https://git.kernel.org/stable/c/35b4f24415c854cd718ccdf38dbea6297f010aae"},{"type":"FIX","url":"https://git.kernel.org/stable/c/61b877bad9bb0d82b7d8841be50872557090a704"},{"type":"FIX","url":"https://git.kernel.org/stable/c/b1b31948c0af44628e43353828453461bb74098f"},{"type":"FIX","url":"https://git.kernel.org/stable/c/d624f2991b977821375fbd56c91b0c91d456a697"},{"type":"FIX","url":"https://git.kernel.org/stable/c/f01988ecf3654f805282dce2d3bb9afe68d2691e"},{"type":"FIX","url":"https://git.kernel.org/stable/c/0bfd913c2121b3d553bfd52810fe6061d542d625"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46999.json","unresolved_ranges":[{"events":[{"introduced":"4.19.123"},{"fixed":"4.19.191"}]},{"events":[{"introduced":"5.4.41"},{"fixed":"5.4.120"}]},{"events":[{"introduced":"5.7"},{"fixed":"5.10.38"}]},{"events":[{"introduced":"5.11"},{"fixed":"5.11.22"}]},{"events":[{"introduced":"5.12"},{"fixed":"5.12.5"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}