CVE-2021-46999

What it actually does

Use-after-free in the SCTP stack where a transport structure from a newly created association is referenced after the original association is freed during duplicate COOKIE-ECHO processing and subsequent T2 timer handling.

Why it matters to the business

Kernel panic or system instability on servers handling SCTP traffic, resulting in unplanned downtime for network services and potential loss of connectivity for dependent applications.

How an attack unfolds

An attacker establishes an SCTP association and then sends a duplicate COOKIE-ECHO chunk crafted to trigger the vulnerable code path in sctp_sf_do_dupcook_a; this causes the old association to later dereference a freed transport during T2 timeout processing, leading to a crash.

How to fix it

Apply the upstream kernel patch that performs the association update before allocating COOKIE-ACK and SHUTDOWN chunks; rebuild and deploy updated kernels containing the fix for CVE-2021-46999.

How to confirm the fix worked

Confirm the patch is present by inspecting the sctp_sf_do_dupcook_a function for the early asoc update, then test with SCTP duplicate COOKIE-ECHO scenarios to ensure no use-after-free occurs on T2 expiry.

Typical attack path

1. Establish initial SCTP association with target
2. Send duplicate COOKIE-ECHO chunk referencing prior state
3. Trigger T2 retransmission timer on the affected association
4. Force access to the now-freed transport structure

How to detect it

Review kernel logs for general protection faults or call traces involving sctp_ulpevent_notify_peer_addr_change, sctp_assoc_control_transport, and sctp_do_8_2_transport_strike; correlate with SCTP traffic containing COOKIE-ECHO chunks shortly before the crash.

What your security team should do

• Prioritize kernel updates on all systems exposing SCTP ports
• Monitor for SCTP-related kernel panics in system logs
• Restrict SCTP exposure to trusted networks where feasible