SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free

The core defect is an identity mismatch in how Linux processes ASCONF chunks under SCTP Dynamic Address Reconfiguration (RFC 5061). A single ASCONF chunk carries two distinct address identities: the IPv4 packet source address S and the Address Parameter L used to select a transport for processing. The DEL-IP operation validates the requested address against S, but later processing steps operate on the transport selected through L. When S and L differ, a DEL-IP targeting L passes the source-address check and removes transport(L), yet a subsequent wildcard DEL-IP reuses the cached pointer to that now-freed transport as the path to preserve. The association then retains dangling references in primary_path and active_path, which a later socket operation can dereference.

The trigger sequence is an ordered ASCONF chunk containing Address Parameter L, followed by DEL-IP L, followed by DEL-IP 0.0.0.0. The first DEL-IP succeeds because the validation compares against S rather than L. The wildcard DEL-IP then uses the stale cached pointer to the already-removed transport(L) as the transport to preserve. This leaves the association with primary_path and active_path pointing to freed memory. The upstream fix closes the gap by rejecting deletion when the selected peer transport is the same one retained for ASCONF chunk processing, eliminating the divergence between validation and usage paths.

The exploit chain demonstrates full local privilege escalation and container-to-host escape on tested systems. It requires three simultaneous conditions: the transport has completed RCU release, the association remains alive, and userspace can still reach the stale pointer through a socket operation. The chain proceeds through two UAF reclamation stages. The first reclaims the freed transport via pg_vec, enabling direct-map page disclosure and a repeatable 4-byte kernel read that recovers KASLR offsets through the IDT. The second reclamation uses controlled SCTP authentication-key data to construct a controlled kernel object graph, which drives a data-oriented commit_creds() call to achieve global root, followed by a usermode-helper variant for container-to-host escape.

The discovery was performed by Corvus AI, a multi-agent vulnerability research pipeline developed by TencentOS Security Team (Tencent Zhuque Lab). The pipeline decomposed the SCTP research into bounded tasks spanning source analysis, packet generation, crash triage, and VM reproduction. The bug emerged specifically after separating the IPv4 packet source from the transport selected through the ASCONF Address Parameter and varying peer transport states. Fresh-boot reproduction confirmed the use-after-free, and the pipeline preserved evidence and constraints across each stage of exploit development so the chain could be validated incrementally.

Only one feed carried this event, so independent corroboration of the technical claims is not available from the provided material. The article itself is detailed and includes a specific CVE identifier, upstream fix commit hash, and a described exploit chain, but engineers should verify against official kernel security advisories before acting. The practical takeaway for operators is to confirm whether running kernels include the fix and to assess exposure based on whether SCTP and ASCONF are enabled or reachable in their environments.