CVE-2014-3673

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-10 · updated 2026-06-17
Weakness: CWE-20

Description

The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.

Affected products

Canonical Ubuntu Linux: 12.04
Debian Linux: 7.0
Linux kernel: from 2.6.12 before 3.2.64; from 3.3 before 3.4.107; from 3.5 before 3.10.61; from 3.11 before 3.12.34; from 3.13 before 3.14.25; from 3.15 before 3.16.35 — fixed in 3.10.61, 3.12.34, 3.14.25, 3.16.35, 3.17.4, 3.2.64
openSUSE Evergreen: 11.4
Oracle Corporation Oracle Linux: 5, 6, 7
Red Hat Enterprise Linux: 5.0
RedHat Enterprise Mrg: 2.0
SUSE Linux Enterprise Software Development Kit: 12
SUSE Linux Enterprise Workstation Extension: 12
SUSE Linux Enterprise: 10-sp4, 11-sp1, 11-sp2, 12

How to fix

Upgrade to a fixed version: Linux kernel 3.10.61, 3.12.34, 3.14.25, 3.16.35. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-3673 or the next vulnerability affects your stack