CVE-2016-2550

NameCVE-2016-2550
DescriptionThe Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3503-1
NVD severitymedium (attack range: local)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie3.16.51-2fixed
jessie (security)3.16.56-1+deb8u1fixed
stretch4.9.82-1+deb9u3fixed
stretch (security)4.9.88-1+deb9u1fixed
buster4.16.12-1fixed
sid4.16.16-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)4.4.4-1medium
linuxsourcejessie3.16.7-ckt20-1+deb8u4mediumDSA-3503-1
linuxsourcewheezy3.2.73-2+deb7u3mediumDSA-3503-1
linux-2.6source(unstable)(unfixed)medium

Notes

Upstream fix: https://git.kernel.org/linus/415e3d3e90ce9e18727e8843ae343eda5a58fad6 (v4.5-rc4)
Introduced by: https://git.kernel.org/linus/712f4aad406bb1ed67f3f98d04c044191f0ff593 (v4.5-rc1)
Technically wheezy-security and squeeze-lts are not affected by this CVE since the fix for
addressing CVE-2013-4312 was not applied.

Search for package or bug name: Reporting problems