Re: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS

[Xin Long]

On Thu, Jul 30, 2026 at 5:02 AM Jun Yang <juny24602@xxxxxxxxx> wrote:
>
> From: Jun Yang <junvyyang@xxxxxxxxxxx>
>
> sctp_getsockopt_local_auth_chunks() copies ntohs(length) -
> sizeof(paramhdr) bytes out of ch->chunks without bounding the count.
> For an association ch is the fixed-size asoc->c.auth_chunks[] array
> (sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS bytes), whose length
> field is restored from the received state cookie by sctp_unpack_cookie()
> and is not validated against the array size.  A cookie carrying an
> oversized length makes copy_to_user() read past the array (out-of-bounds
> read).
>
> Bound the chunk count to SCTP_AUTH_MAX_CHUNKS before the copy.  That is
> the most valid chunk bytes either source can hold, so legitimate output
> is unchanged, and it also covers a stored length smaller than the
> parameter header, which would otherwise underflow.
>
> Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
> Cc: stable@xxxxxxxxxx
> Reported-by: TencentOS Corvus AI <corvus@xxxxxxxxxxx>
> Signed-off-by: Jun Yang <junvyyang@xxxxxxxxxxx>
> ---
>  net/sctp/socket.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 9a6da4e0d741..3e9dacb772a0 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -7109,6 +7109,12 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
>                 goto num;
>
>         num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
> +       /* asoc->c.auth_chunks[] holds at most SCTP_AUTH_MAX_CHUNKS bytes but its
> +        * length is restored from the state cookie and is not bounded here;
> +        * clamp so an oversized length cannot read past the array.
> +        */
> +       if (num_chunks > SCTP_AUTH_MAX_CHUNKS)
> +               num_chunks = SCTP_AUTH_MAX_CHUNKS;
>         if (len < sizeof(struct sctp_authchunks) + num_chunks)
>                 return -EINVAL;
>
> --
> 2.55.0
>
The issue requires sysctl net.sctp.cookie_hmac_alg=none, right?

If so, Jean Jeremy has reported two issues caused by the missing validation
of the auth params in the cookie. We may need to validate all auth_random,
auth_hmacs and auth_chunks in sctp_unpack_cookie().

Let's wait a bit and see if he proceeds with the fix I've suggested.

Thanks.