CVE-2023-1074

What it actually does

Memory leak in Linux kernel SCTP implementation triggered when a local user starts a malicious SCTP networking service and another process connects to it, allowing gradual resource exhaustion leading to denial of service.

Why it matters to the business

Systems may experience gradual memory depletion causing service outages or crashes on Linux hosts handling SCTP traffic, increasing operational downtime risk especially in network-heavy environments.

How an attack unfolds

An attacker with local access starts a malicious SCTP service; when a victim process or user connects, the kernel leaks memory on each interaction until resources are starved and the system becomes unresponsive.

How to fix it

Upgrade the Linux kernel to a version containing the SCTP memory leak fix; apply the latest stable kernel updates from the distribution vendor and reboot affected systems.

How to confirm the fix worked

Verify the running kernel version against the fixed release notes; monitor system memory usage under SCTP load and confirm no unexpected leaks occur after patching.

Typical attack path

1. Obtain local access on a Linux system
2. Start a malicious SCTP-based networking service
3. Trigger connections from target processes or users to the service
4. Repeat connections to accelerate memory leak
5. Wait for resource exhaustion to cause denial of service

How to detect it

Monitor kernel logs and system memory statistics for unusual SCTP activity or steady memory growth without corresponding workload; review process creation events involving SCTP sockets.

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-user Linux systems
• Restrict local user permissions where SCTP services are unnecessary
• Implement resource limits and monitoring for SCTP-related processes
• Schedule regular kernel patching cycles to address similar memory issues