{
  "threat_severity" : "Important",
  "public_date" : "2014-07-17T00:00:00Z",
  "bugzilla" : {
    "description" : "Kernel: net: SCTP: fix a NULL pointer dereference during INIT collisions",
    "id" : "1122982",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1122982"
  },
  "cvss" : {
    "cvss_base_score" : "7.1",
    "cvss_scoring_vector" : "AV:N/AC:M/Au:N/C:N/I:N/A:C",
    "status" : "verified"
  },
  "cwe" : "CWE-476",
  "details" : [ "The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.", "A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system." ],
  "statement" : "This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as it doesn't provide support for AUTH chunks.\nThis issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and 7. Future kernel updates for Red Hat Enterprise Linux 6 and 7 may address this issue. This issue has been fixed in Red Hat Enterprise MRG via RHSA-2014:1083.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2014-10-13T00:00:00Z",
    "advisory" : "RHSA-2014:1392",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "kernel-0:2.6.32-504.el6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.2 Advanced Update Support",
    "release_date" : "2014-10-30T00:00:00Z",
    "advisory" : "RHSA-2014:1763",
    "cpe" : "cpe:/o:redhat:rhel_mission_critical:6.2",
    "package" : "kernel-0:2.6.32-220.56.1.el6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.4 Extended Update Support",
    "release_date" : "2014-11-18T00:00:00Z",
    "advisory" : "RHSA-2014:1872",
    "cpe" : "cpe:/o:redhat:rhel_eus:6.4",
    "package" : "kernel-0:2.6.32-358.51.1.el6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6.5 Extended Update Support",
    "release_date" : "2014-10-23T00:00:00Z",
    "advisory" : "RHSA-2014:1668",
    "cpe" : "cpe:/o:redhat:rhel_eus:6.5",
    "package" : "kernel-0:2.6.32-431.37.1.el6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2014-10-28T00:00:00Z",
    "advisory" : "RHSA-2014:1724",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kernel-0:3.10.0-123.9.2.el7"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "release_date" : "2014-08-20T00:00:00Z",
    "advisory" : "RHSA-2014:1083",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2:server:el6",
    "package" : "kernel-rt-0:3.10.33-rt32.45.el6rt"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2014-5077\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-5077" ],
  "name" : "CVE-2014-5077",
  "csaw" : false
}