CVE-2016-8666

NameCVE-2016-8666
DescriptionThe IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)buster4.19.235-1fixed
buster (security)4.19.249-2fixed
bullseye5.10.127-1fixed
bullseye (security)5.10.127-2fixed
bookworm, sid5.18.14-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcewheezy(not affected)
linuxsourcejessie3.6.36-1
linuxsource(unstable)4.6.1-1

Notes

[wheezy] - linux <not-affected> (Vulnerable code introduced later)
Fixed by: https://git.kernel.org/linus/fac8e0f579695a3ecbc4d3cac369139d7f819971
Introduced by: htttps://git.kernel.org/linus/bf5a755f5e9186406bbf50f4087100af5bd68e40
https://www.openwall.com/lists/oss-security/2016/10/13/11

Search for package or bug name: Reporting problems