« Volver al listado

CVE-2026-15422

Estado: AplazadaCrítica (9.1)—

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS:4.0 AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). Corrupción de heap del kernel en pila SCTP puede llevar a ejecución de código remoto (T1059) y potencialmente privilegios de root (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Illumos — IllumosAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-15422",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15422",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-17T13:47:43.135041Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "0ca53633-f0b5-4853-ba72-e0a2e62000d0",
        "cvssData": {
          "Safety": "PRESENT",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 9.1,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red",
          "exploitMaturity": "UNREPORTED",
          "providerUrgency": "RED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "HIGH",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "0ca53633-f0b5-4853-ba72-e0a2e62000d0",
      "affectedData": [
        {
          "repo": "https://github.com/illumos/illumos-gate",
          "vendor": "illumos",
          "modules": [
            "kernel",
            "SCTP"
          ],
          "product": "illumos-gate",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "53a3efdeff8e6745bbfb69c5360f94962fb79e75",
                  "status": "unaffected"
                }
              ],
              "version": "a5407c02d5ed61b29481b9b71f1307d7ebec9e5c",
              "lessThan": "53a3efdeff8e6745bbfb69c5360f94962fb79e75",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "usr/src/uts/common/inet/sctp/sctp_hash.c"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "OmniOS",
          "product": "OmniOS",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "r151058j",
                  "status": "unaffected"
                }
              ],
              "version": "r151058",
              "lessThan": "r151058j",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "r151056aj",
                  "status": "unaffected"
                }
              ],
              "version": "r151056",
              "lessThan": "r151056aj",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "r151054bj",
                  "status": "unaffected"
                }
              ],
              "version": "r151054",
              "lessThan": "r151054bj",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "any",
              "lessThan": "r151054",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Triton Data Center",
          "product": "SmartOS",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "20260709",
                  "status": "unaffected"
                }
              ],
              "version": "any",
              "lessThan": "202060709",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-16T20:16:44.190",
  "references": [
    {
      "url": "https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75",
      "source": "0ca53633-f0b5-4853-ba72-e0a2e62000d0"
    },
    {
      "url": "https://illumos.org/issues/18117",
      "source": "0ca53633-f0b5-4853-ba72-e0a2e62000d0"
    },
    {
      "url": "https://illumos.topicbox.com/groups/developer/Ta1a8e2e1f7f928df/18117-sctp-needs-to-better-check-init-ack-chunk-parameters",
      "source": "0ca53633-f0b5-4853-ba72-e0a2e62000d0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0ca53633-f0b5-4853-ba72-e0a2e62000d0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde."
    }
  ],
  "lastModified": "2026-07-17T18:45:53.333",
  "sourceIdentifier": "0ca53633-f0b5-4853-ba72-e0a2e62000d0"
}