Skip to content

CVE-2016-5696 net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-win...

MediumCVSS 4.8 EPSS 14.5%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.

Affected products

ProductAffected versionsFixed in
debian/linux(Debian:12) < 4.7.2-1 4.7.2-1
debian/linux(Debian:13) < 4.7.2-1 4.7.2-1
debian/linux(Debian:14) < 4.7.2-1 4.7.2-1
Google Android <= 7.0 No fix listed
oracle vm server = 3.3 No fix listed
oracle vm server = 3.4 No fix listed
Linux kernel <= 4.6.6 No fix listed

References