gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…packet/security/advisories/GHSA-358w-w75h-x6rx Diğer
• github.com/…ommit/508044327cc2c065b3db753c010a027e7d1ca621 Diğer
• github.com/gopacket/gopacket/releases/tag/v1.7.2 Diğer

Kayıt geçmişi

1. 30 Eki 2026 19:23Yayımlandı

İlgili açıklar

• 7,9 CVE-2026-62958libriscv ELF ayrıştırıcısında sınır dışı bellek okuma açığı
• 6,9 CVE-2026-119338Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
• 7,8 CVE-2026-119722Blender'da read_struct fonksiyonunda heap sınır dışı bellek erişimi açığı
• 5,5 CVE-2026-119720Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
• 6,1 CVE-2026-119721Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
• 6,1 CVE-2026-104063Scribus before 1.6.7 Out-of-Bounds Read via PICT Planar Image Data