PT-2016-7126 · Linux+5 · Linux Kernel+5

Marco Grassi · Published 2016-08-18 · Updated 2024-06-15 · CVE-2016-6828

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.7.5

Description The issue is related to the tcp check send head function in the Linux kernel, which does not properly maintain certain SACK state after a failed data copy. This allows local users to cause a denial of service, resulting in a tcp xmit retransmit queue use-after-free and system crash, via a crafted SACK option.

Recommendations For Linux kernel versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2016-2022

ALT-PU-2017-1330

CESA-2017_0036

CESA-2017_0086

CVE-2016-6828

DLA-609-1

DSA-3659-1

MGASA-2016-0347

MGASA-2016-0364

OPENSUSE-SU-2016_2290-1

OPENSUSE-SU-2016_2625-1

OPENSUSE-SU-2016_3021-1

OPENSUSE-SU-2024:10128-1

RHSA-2017:0036

RHSA-2017:0086

RHSA-2017:0091

RHSA-2017:0113

RHSA-2017_0036

RHSA-2017_0086

RHSA-2017_0091

SUSE-SU-2016:2912-1

SUSE-SU-2016:2976-1

SUSE-SU-2016:3069-1

SUSE-SU-2016:3304-1

SUSE-SU-2017:0333-1

SUSE-SU-2017:0471-1

SUSE-SU-2017:0494-1

USN-3097-1

USN-3097-2

USN-3098-1

USN-3098-2

USN-3099-1

USN-3099-2

USN-3099-3

USN-3099-4

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 511

• 🔥 https://exploit-db.com/exploits/40731 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2016/08/15/1 · Exploit
• https://github.com/torvalds/linux/commit/bb1fceca22492109be12640d49f5ea5a544c6bb4 · Patch
• https://osv.dev/vulnerability/MGASA-2016-0364 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0364.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0036.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3099-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6136 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6828 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3097-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3099-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-3508.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3099-4 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb1fceca22492109be12640d49f5ea5a544c6bb4 · Patch
• https://osv.dev/vulnerability/CVE-2016-6828 · Vendor Advisory