CVE-2024-0639

What it actually does

A race condition in sctp_auto_asconf_init allows a local user to induce a deadlock within the SCTP subsystem, resulting in a kernel hang or crash.

Why it matters to the business

Local users on Linux systems using SCTP can trigger repeated crashes that interrupt services and require manual restarts, increasing operational overhead even though the flaw is not remotely exploitable.

How an attack unfolds

An attacker with local user privileges loads or exercises SCTP socket code paths that invoke sctp_auto_asconf_init, races the initialization logic to acquire a lock already held by another context, and forces the kernel into a deadlock that halts the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a or apply the equivalent vendor back-port that resolves the deadlock in sctp_auto_asconf_init.

How to confirm the fix worked

Confirm the running kernel contains commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a or a later equivalent fix; attempt to reproduce the deadlock with a local SCTP test program on an unpatched system and verify it no longer occurs after the update.

Typical attack path

1. Obtain a local shell or user account on the target Linux system
2. Create or bind an SCTP socket that exercises the auto-asconf code path
3. Trigger concurrent operations that race in sctp_auto_asconf_init
4. Cause kernel deadlock leading to system crash or reboot

How to detect it

Review kernel logs and crash dumps for entries referencing sctp_auto_asconf_init, deadlock warnings, or hung tasks involving SCTP sockets; correlate with process activity that opens SCTP sockets shortly before the incident.

• sctp_auto_asconf_init
• deadlock.*sctp
• hung_task.*sctp

What your security team should do

• Identify all systems running vulnerable kernels that have SCTP enabled and schedule immediate updates to the fixed commit
• Restrict local user access on systems where SCTP is required until patches are applied
• Monitor kernel crash logs for SCTP-related deadlocks as an interim detection measure