5.5

CVE-2016-6828

Exploit
The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version <= 4.7.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.18% 0.638
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4.9 3.9 6.9
AV:L/AC:L/Au:N/C:N/I:N/A:C
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://source.android.com/security/bulletin/2016-11-01.html
http://rhn.redhat.com/errata/RHSA-2017-0036.html
http://rhn.redhat.com/errata/RHSA-2017-0086.html
http://rhn.redhat.com/errata/RHSA-2017-0091.html
http://rhn.redhat.com/errata/RHSA-2017-0113.html
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb1fceca22492109be12640d49f5ea5a544c6bb4
Patch
Issue Tracking
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.5
Third Party Advisory
Release Notes
http://www.openwall.com/lists/oss-security/2016/08/15/1
Third Party Advisory
Exploit
http://www.securityfocus.com/bid/92452
https://bugzilla.redhat.com/show_bug.cgi?id=1367091
Third Party Advisory
Issue Tracking
https://github.com/torvalds/linux/commit/bb1fceca22492109be12640d49f5ea5a544c6bb4
Patch
Issue Tracking
https://marcograss.github.io/security/linux/2016/08/18/cve-2016-6828-linux-kernel-tcp-uaf.html