What’s Vulnerable › Vulnerabilities

CVE-2014-3687

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-11-10 · updated 2026-06-17
• Weakness: CWE-400

Description

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

Affected products

• Canonical Ubuntu Linux: 12.04
• Debian Linux: 7.0
• Linux kernel: from 2.6.27 before 3.2.64; from 3.3 before 3.4.107; from 3.5 before 3.10.61; from 3.11 before 3.12.34; from 3.13 before 3.14.25; from 3.15 before 3.16.35 — fixed in 3.10.61, 3.12.34, 3.14.25, 3.16.35, 3.17.4, 3.2.64
• Novell Suse Linux Enterprise Desktop: 12.0
• Novell Suse Linux Enterprise Server: 12.0
• openSUSE Evergreen: 11.4
• Oracle Corporation Oracle Linux: 5, 6, 7
• RedHat Enterprise Mrg: 2.0
• SUSE Linux Enterprise Real Time Extension: 11-sp3
• SUSE Linux Enterprise Software Development Kit: 12
• SUSE Linux Enterprise Workstation Extension: 12
• SUSE Linux Enterprise: 11-sp2

How to fix

Upgrade to a fixed version: Linux kernel 3.10.61, 3.12.34, 3.14.25, 3.16.35. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b69040d8e39f20d5215a03502a8e8b4c6ab78395
• http://linux.oracle.com/errata/ELSA-2014-3087.html
• http://linux.oracle.com/errata/ELSA-2014-3088.html
• http://linux.oracle.com/errata/ELSA-2014-3089.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
• http://marc.info/?l=bugtraq&m=142722450701342&w=2

Get alerted when CVE-2014-3687 or the next vulnerability affects your stack