ANT-2026-Q430PMKE · linux-sctp

heap-buffer-overflow low

Severity Claude high · Security research firm low · Maintainer -

Discovered by Claude Opus 4.6

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-Q430PMKE: Heap-buffer-overflow in sendmsg.c:169

A compiled PoC binary deterministically triggers a heap-buffer-overflow in the lksctp-tools userspace library. The fault occurs inside sctp_sendv (src/lib/sendmsg.c:169), where the code performs a 2-byte read immediately past the end of a 16-byte heap buffer. The overflow reproduced identically across 3 independent runs in a fresh linux-sctp:latest container and is confirmed to be in project code rather than a dependency. No details on attacker-controlled inputs or downstream impact were provided.

Target

Project: linux-sctp
Location: sendmsg.c:169

Technical Details

ASAN: heap-buffer-overflow, READ of size 2, 0 bytes to the right of a 16-byte heap region, at sctp_sendv (sendmsg.c:169). The library reads a 2-byte value starting exactly at the end boundary of a 16-byte allocation, indicating a missing or incorrect length/bounds check on a caller-supplied structure before it is dereferenced.

Crash trace:

The PoC is a compiled ELF binary (21,520 bytes) that triggers a deterministic heap-buffer-overflow in the lksctp-tools project.

All 3 reproduction runs in a fresh `linux-sctp:latest` container produced identical ASAN reports:
- Error type: heap-buffer-overflow (READ of size 2)
- Crash location: `sctp_sendv` in `/workspace/lksctp-tools/src/lib/sendmsg.c:169`
- The overflow reads 0 bytes past the right end of a 16-byte heap allocation
- Exit code: 1 (all runs)

The crash is:
- Deterministic (3/3 runs)
- In project code (lksctp-tools `sctp_sendv`)
- Not OOM or timeout
- A genuine heap-buffer-overflow memory safety bug

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-Q430PMKE.

Reference: ANT-2026-Q430PMKE
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: will not fix
Severity: low

The reviewing firm confirmed this is a real issue. The maintainer indicated it would not be addressed.

TIMELINE

Dates from discovery through public reveal.

2026-02-28 Sent to maintainer
2026-02-28 Maintainer acknowledged
2026-03-24 Reported to tracker
2026-05-29 Publicly revealed

PROVENANCE

SHA-3-512 hash:

c54cecb1ce6825a31fc73c698315249bad576626c38b1218a5997c02b0bb0d6b6c0872d8fa1cc5ee818bd0da0eb406578dcfeb118099d7cce3af010babbed563

Committed 2026-02-28 16:00 PT

Revealed 2026-05-29 17:00 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-Q430PMKE",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-24T18:44:54+00:00",
  "description": "A compiled PoC binary deterministically triggers a heap-buffer-overflow in the lksctp-tools userspace library. The fault occurs inside sctp_sendv (src/lib/sendmsg.c:169), where the code performs a 2-byte read immediately past the end of a 16-byte heap buffer. The overflow reproduced identically across 3 independent runs in a fresh linux-sctp:latest container and is confirmed to be in project code rather than a dependency. No details on attacker-controlled inputs or downstream impact were provided.",
  "discovered_at": null,
  "location": "sendmsg.c:169",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "linux-sctp",
  "reproduction": null,
  "technical_details": "ASAN: heap-buffer-overflow, READ of size 2, 0 bytes to the right of a 16-byte heap region, at sctp_sendv (sendmsg.c:169). The library reads a 2-byte value starting exactly at the end boundary of a 16-byte allocation, indicating a missing or incorrect length/bounds check on a caller-supplied structure before it is dereferenced.",
  "title": "Heap-buffer-overflow in sendmsg.c:169",
  "vendor_severity": null
}