Generic TLV validity is not type validity.

SCTP INIT parameters are TLVs. Generic TLV validation can prove a parameter header is present and internally parseable — but that does not prove a fixed-layout parameter contains all the fields its concrete type requires.

The Adaptation Layer Indication parameter has a fixed layout: a four-byte SCTP parameter header followed by a 32-bit Adaptation Code Point. The peer controls the declared length.

A fixed-layout SCTP parameter must be validated against the size of its complete typed structure before code reads fields beyond the generic parameter header.

Before the fix, the verification switch grouped Adaptation Layer Indication with parameters that required no additional type-specific validation:

case SCTP_PARAM_UNRECOGNIZED_PARAMETERS:
case SCTP_PARAM_ECN_CAPABLE:
case SCTP_PARAM_ADAPTATION_LAYER_IND:
	break;

Later, ordinary parameter processing assumed the full structure existed:

case SCTP_PARAM_ADAPTATION_LAYER_IND:
	asoc->peer.adaptation_ind = ntohl(param.aind->adaptation_ind);
	break;

Two parser layers disagreed: the generic walker accepted a four-byte header, and the type-specific consumer read a field beginning after those four bytes.

This is more than a local out-of-bounds read inside the parser. When the malformed parameter is the last one in an INIT, the missing field is not attacker-supplied parameter data at all — it begins at receive-buffer tailroom. The value read as adaptation_ind then becomes peer association state and is incorporated into the SCTP state cookie returned in the INIT ACK.

The research used three controls together rather than relying on a crash or on source inspection alone. The strongest local A/B comparison held the kernel base, configuration, guest setup, probe and input shape constant, changing only the patch state.

Parser correctness cannot depend on allocator initialization masking an invalid access.

Mainline commit 74b21f52c5c5 separates Adaptation Layer Indication from the no-extra-validation cases and checks the complete structure size:

case SCTP_PARAM_ADAPTATION_LAYER_IND:
	if (ntohs(param.p->length) != sizeof(*param.aind)) {
		sctp_process_inv_paramlength(asoc, param.p,
					     chunk, err_chunk);
		retval = SCTP_IERROR_ABORT;
	}
	break;

A malformed parameter now follows the existing invalid-parameter-length handling path, and association processing is aborted before sctp_process_param() can read the missing field.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Charles Vosburgh <trilobyte777@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

The Fixes: tag names the public upstream vulnerable lineage. This page does not claim that every intervening release was independently executed. Directly reviewed vulnerable source included Linux 7.1.4, Linux 7.2-rc4 and the pre-fix networking-tree base.

Kernel vendors and downstream distributions should still verify the exact patch status of the branch they ship rather than infer it from version numbering.

A durable regression test should keep all three parser cases together:

1. baseline INIT succeeds;
2. a valid eight-byte Adaptation Indication succeeds and retains the supplied value;
3. a header-only Adaptation Indication is rejected before any typed payload read.

Testing under both clearing and non-clearing allocation profiles is useful. The malformed input should be rejected for parser correctness regardless of whether the surrounding allocator would otherwise make the invalid bytes appear to be zero.

No fixed-layout SCTP field may be read until the parameter length has been validated against the complete structure required by that parameter type.

1. Linux mainline commit 74b21f52c5c5
2. git.kernel.org commit view
3. Patch submission and review thread

Credit: Patch authored by Charles Vosburgh and carried upstream with Signed-off-by: Charles Vosburgh. Acknowledged by Xin Long and signed into the networking tree by Jakub Kicinski. Research was AI-assisted through source mapping and hypothesis generation; validation, patch authorship and upstream submission remained human.