{"id":70239,"date":"2025-09-16T12:32:17","date_gmt":"2025-09-16T09:02:17","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2023-53296-sctp-check-send-stream-number-after-wait_for_sndbuf\/"},"modified":"2025-09-16T12:32:17","modified_gmt":"2025-09-16T09:02:17","slug":"cve-2023-53296-sctp-check-send-stream-number-after-wait_for_sndbuf","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2023-53296-sctp-check-send-stream-number-after-wait_for_sndbuf\/","title":{"rendered":"CVE-2023-53296 &#8211; sctp: check send stream number after wait_for_sndbuf"},"content":{"rendered":"<p><strong>CVE ID : <\/strong>CVE-2023-53296<br \/>\n<br \/>\n<strong>Published : <\/strong> Sept. 16, 2025, 8:11 a.m. | 44\u00a0minutes ago<br \/>\n<br \/>\n<strong>Description : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sctp: check send stream number after wait_for_sndbuf<\/p>\n<p>This patch fixes a corner case where the asoc out stream count may change<br \/>\nafter wait_for_sndbuf.<\/p>\n<p>When the main thread in the client starts a connection, if its out stream<br \/>\ncount is set to N while the in stream count in the server is set to N &#8211; 2,<br \/>\nanother thread in the client keeps sending the msgs with stream number<br \/>\nN &#8211; 1, and waits for sndbuf before processing INIT_ACK.<\/p>\n<p>However, after processing INIT_ACK, the out stream count in the client is<br \/>\nshrunk to N &#8211; 2, the same to the in stream count in the server. The crash<br \/>\noccurs when the thread waiting for sndbuf is awake and sends the msg in a<br \/>\nnon-existing stream(N &#8211; 1), the call trace is as below:<\/p>\n<p>  KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n  Call Trace:<\/p>\n<p>   sctp_cmd_send_msg net\/sctp\/sm_sideeffect.c:1114 [inline]\n   sctp_cmd_interpreter net\/sctp\/sm_sideeffect.c:1777 [inline]\n   sctp_side_effects net\/sctp\/sm_sideeffect.c:1199 [inline]\n   sctp_do_sm+0x197d\/0x5310 net\/sctp\/sm_sideeffect.c:1170<br \/>\n   sctp_primitive_SEND+0x9f\/0xc0 net\/sctp\/primitive.c:163<br \/>\n   sctp_sendmsg_to_asoc+0x10eb\/0x1a30 net\/sctp\/socket.c:1868<br \/>\n   sctp_sendmsg+0x8d4\/0x1d90 net\/sctp\/socket.c:2026<br \/>\n   inet_sendmsg+0x9d\/0xe0 net\/ipv4\/af_inet.c:825<br \/>\n   sock_sendmsg_nosec net\/socket.c:722 [inline]\n   sock_sendmsg+0xde\/0x190 net\/socket.c:745<\/p>\n<p>The fix is to add an unlikely check for the send stream number after the<br \/>\nthread wakes up from the wait_for_sndbuf.<br \/>\n<br \/>\n<strong>Severity:<\/strong> 0.0 | NA<br \/>\n<br \/>\nVisit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2023-53296 Published : Sept. 16, 2025, 8:11 a.m. | 44\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-70239","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=70239"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70239\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=70239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=70239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=70239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}