CVE-2016-8666

NameCVE-2016-8666
DescriptionThe IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)wheezy3.2.78-1fixed
wheezy (security)3.2.89-2fixed
jessie3.16.43-2fixed
jessie (security)3.16.43-2+deb8u2fixed
stretch4.9.30-2fixed
stretch (security)4.9.30-2+deb9u2fixed
buster4.11.6-1fixed
sid4.11.11-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)4.6.1-1high
linuxsourcejessie3.6.36-1high
linuxsourcewheezy(not affected)

Notes

[wheezy] - linux <not-affected> (Vulnerable code introduced later)
Fixed by: https://git.kernel.org/linus/fac8e0f579695a3ecbc4d3cac369139d7f819971
Introduced by: htttps://git.kernel.org/linus/bf5a755f5e9186406bbf50f4087100af5bd68e40
http://www.openwall.com/lists/oss-security/2016/10/13/11

Search for package or bug name: Reporting problems