CVE-2015-3212

What it actually does

Race condition in net/sctp/socket.c allows local users to trigger list corruption and kernel panic through concurrent SCTP socket operations.

Why it matters to the business

Local users can crash affected Linux systems, causing unplanned downtime and loss of availability for any workloads running on the host.

How an attack unfolds

An attacker with local access on an unpatched kernel rapidly issues setsockopt calls against SCTP sockets, winning the race and corrupting internal kernel lists, which triggers a panic.

How to fix it

Upgrade the Linux kernel to version 4.1.2 or later; disable SCTP if unused via modprobe blacklist or sysctl; apply vendor-supplied backports for supported distributions.

How to confirm the fix worked

Confirm kernel version is 4.1.2 or newer; attempt to reproduce the race condition in a test environment and verify no panic occurs; review kernel changelog for the SCTP socket fix.

Typical attack path

1. Obtain local shell on target Linux system
2. Create or bind SCTP sockets
3. Issue a rapid series of setsockopt system calls
4. Trigger list corruption leading to kernel panic

How to detect it

Review kernel logs and dmesg for panic messages mentioning list corruption or sctp; look for unusual patterns of setsockopt calls in auditd or strace output from local processes.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant systems
• Audit for SCTP usage and disable the module where not required
• Monitor kernel logs for unexplained panics referencing sctp or socket lists