CVE-2016-2550

NameCVE-2016-2550
DescriptionThe Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3503-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)stretch4.9.228-1fixed
stretch (security)4.9.240-2fixed
buster4.19.146-1fixed
buster (security)4.19.152-1fixed
bullseye5.9.9-1fixed
sid5.9.11-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcewheezy3.2.73-2+deb7u3DSA-3503-1
linuxsourcejessie3.16.7-ckt20-1+deb8u4DSA-3503-1
linuxsource(unstable)4.4.4-1
linux-2.6source(unstable)(unfixed)

Notes

Upstream fix: https://git.kernel.org/linus/415e3d3e90ce9e18727e8843ae343eda5a58fad6 (v4.5-rc4)
Introduced by: https://git.kernel.org/linus/712f4aad406bb1ed67f3f98d04c044191f0ff593 (v4.5-rc1)
Technically wheezy-security and squeeze-lts are not affected by this CVE since the fix for
addressing CVE-2013-4312 was not applied.

Search for package or bug name: Reporting problems