PT-2016-7545 · Linux+4 · Linux Kernel+4

Adam Mariš · Published 2016-06-22 · Updated 2023-01-18 · CVE-2016-8666

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.6

Description The issue allows remote attackers to cause a denial of service, potentially leading to stack consumption and panic, by triggering use of the GRO path for packets with tunnel stacking. This can be demonstrated by interleaved IPv4 headers and GRE headers.

Recommendations For Linux kernel versions prior to 4.6, update to version 4.6 or later to resolve the issue.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2016-1634

ALT-PU-2016-2226

CESA-2016_2047

CVE-2016-8666

MGASA-2016-0372

OPENSUSE-SU-2016_2584-1

OPENSUSE-SU-2016_3050-1

RHSA-2016:2047

RHSA-2016:2107

RHSA-2016:2110

RHSA-2016_2047

RHSA-2016_2110

RHSA-2017:0004

RHSA-2017:0372

RHSA-2017_0372

SUSE-SU-2016:2629-1

SUSE-SU-2016:2630-1

SUSE-SU-2016:2631-1

SUSE-SU-2016:2634-1

SUSE-SU-2016:2635-1

SUSE-SU-2016:2637-1

SUSE-SU-2016:2638-1

SUSE-SU-2016:2673-1

SUSE-SU-2016:2674-1

SUSE-SU-2016:2912-1

SUSE-SU-2017:0181-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

References · 317

• https://osv.dev/vulnerability/SUSE-SU-2016:2638-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2110.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2634-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2629-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0181-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2635-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8666 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2673-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2047.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8666 · Security Note
• https://linux.oracle.com/errata/ELSA-2017-3508.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2631-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8666 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2674-1 · Vendor Advisory