sctp AuthChunkList Overflow

Vulnerability analysis

The SCTP authentication subsystem permits an endpoint's auth chunk list to grow to 20 entries, but the association cookie structure that receives a copy of that list during association initialization only has room for 16 entries. When more than 16 chunk types have been configured and an association is formed, the kernel's copy operation writes up to four bytes past the end of the cookie buffer, corrupting adjacent heap memory. The fix changes the capacity check to limit the chunk list to 16 entries, matching the destination buffer size and preventing the overflow. Any local user who can create an SCTP socket and set authentication options via setsockopt can trigger this; no special privileges are required, and the association can be established over loopback.