A critical stack-based buffer overflow in Erlang OTP erts allows unauthenticated remote attackers to cause a denial-of-service condition by crashing the BEAM virtual machine.

This vulnerability is a stack-based buffer overflow located within the inet_drv component. It permits an unauthenticated remote attacker to trigger a crash of the BEAM VM by sending a specially crafted SCTP ERROR chunk.

The ability for an unauthenticated attacker to remotely crash the BEAM VM poses a significant risk to service availability. Given the CVSS score of 8.2, this vulnerability is classified as high severity, as it can lead to unplanned system downtime for any application relying on the Erlang runtime, potentially disrupting critical business operations.

Immediate Action: Identify and update all instances of Erlang OTP to the latest patched version provided by the vendor.

Proactive Monitoring: Monitor system logs for unusual SCTP traffic or unexpected process terminations of the BEAM VM.

Compensating Controls: Utilize network-level filtering or an Intrusion Prevention System (IPS) to block malformed SCTP packets targeting the Erlang runtime environment.

Public Exploit Available: false

Given the potential for remote service disruption without the need for authentication, organizations should treat this vulnerability with high priority. Administrators must prioritize patching the Erlang runtime across their infrastructure to mitigate the risk of denial-of-service attacks.