)]}'
{
  "commit": "f8373d7090b745728de66308deeecc67e8d319ce",
  "tree": "5af795adee2dd851c0090a2115ffa86d3e76e92c",
  "parents": [
    "d930276f2cddd0b7294cac7a8fe7b877f6d9e08d"
  ],
  "author": {
    "name": "Michael Bommarito",
    "email": "michael.bommarito@gmail.com",
    "time": "Mon Jun 08 08:22:34 2026 -0400"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Tue Jun 09 18:12:30 2026 -0700"
  },
  "message": "sctp: fix uninit-value in __sctp_rcv_asconf_lookup()\n\n__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF\nchunk can hold the ADDIP header and a parameter header, then calls\naf-\u003efrom_addr_param(), which reads the full address (16 bytes for IPv6)\ntrusting the parameter\u0027s declared length.\n\nAn unauthenticated peer can send a truncated trailing ASCONF chunk that\ndeclares an IPv6 address parameter but stops after the 4-byte parameter\nheader; reached from the no-association lookup path, from_addr_param() then\nreads uninitialized bytes past the parameter.\n\nImpact: an unauthenticated SCTP peer makes the receive path read up to 16\nbytes of uninitialized memory past a truncated ASCONF address parameter.\n\nThe sibling __sctp_rcv_init_lookup() bounds parameters with\nsctp_walk_params(); this path open-codes the fetch and omits the bound.\nVerify the whole address parameter lies within the chunk before\nfrom_addr_param() reads it, the same class of fix as commit 51e5ad549c43\n(\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").\n\nFixes: df2185771439 (\"[SCTP]: Update association lookup to look at ASCONF chunks as well\")\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e119e460ccde0b8ac68e10ca2cb1f1c2c5e9cccf",
      "old_mode": 33188,
      "old_path": "net/sctp/input.c",
      "new_id": "864741fae4187e3645474b97e47ba154591b30b2",
      "new_mode": 33188,
      "new_path": "net/sctp/input.c"
    }
  ]
}