CVE-2016-8666
Published: October 16, 2016Last modified: April 24, 2024
Description
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | Stream | linux-lts | Not affected (6.1.33-r0) |
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971
- http://rhn.redhat.com/errata/RHSA-2016-2047.html
- http://rhn.redhat.com/errata/RHSA-2016-2107.html
- http://rhn.redhat.com/errata/RHSA-2016-2110.html
- http://rhn.redhat.com/errata/RHSA-2017-0004.html
- http://www.openwall.com/lists/oss-security/2016/10/13/11
- http://www.securityfocus.com/bid/93562
- https://access.redhat.com/errata/RHSA-2017:0372
- https://bto.bluecoat.com/security-advisory/sa134
- https://bugzilla.redhat.com/show_bug.cgi?id=1384991
- https://bugzilla.suse.com/show_bug.cgi?id=1001486
- https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971