CVE-2024-57938: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57938 is a vulnerability discovered in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The issue was identified in the sctp_association_init() function where an integer overflow could occur when setting the autoclose timer. While by default max_autoclose equals to INT_MAX / HZ, users can set net.sctp.max_autoclose to UINT_MAX, which could trigger the overflow condition (NVD).

The vulnerability is classified as an Integer Overflow or Wraparound (CWE-190) with a CVSS v3.1 Base Score of 5.5 (Medium) and vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue specifically occurs in the sctp_association_init() function where the autoclose timer value is calculated without proper type casting, potentially leading to an integer overflow when multiplying sp->autoclose with HZ (NVD).

The vulnerability affects multiple versions of the Linux kernel, including versions from 3.13 up to (excluding) 5.4.289, 5.5 to 5.10.233, 5.11 to 5.15.176, 5.16 to 6.1.124, 6.2 to 6.6.70, and 6.7 to 6.12.9, as well as several release candidates of version 6.13 (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation. The attack vector is local, meaning an attacker would need access to the affected system to exploit this vulnerability (NVD).

A fix has been implemented by modifying the calculation of the autoclose timer value in the sctp_association_init() function. The patch adds proper type casting to (unsigned long) before performing the multiplication with HZ to prevent the integer overflow (Kernel Patch).