CVE-2016-7039 The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO...
HighCVSS 7.5
EPSS 7.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.7.8-1 | 4.7.8-1 |
| debian/linux(Debian:13) | < 4.7.8-1 | 4.7.8-1 |
| debian/linux(Debian:14) | < 4.7.8-1 | 4.7.8-1 |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| oracle vm server | = 3.4 | No fix listed |
| Linux kernel | >= 4.0, < 4.1.37 | 4.1.37 |
| Linux kernel | >= 4.2, < 4.4.32 | 4.4.32 |
| Linux kernel | >= 4.5, < 4.8.8 | 4.8.8 |
References
- Debian Security Tracker CVE-2016-7039 vendor-advisory
- RHSA-2016:2047 third-party-advisory vendor-advisory
- RHSA-2016:2107 third-party-advisory vendor-advisory
- RHSA-2016:2110 third-party-advisory vendor-advisory
- [oss-security] 20161010 CVE-2016-7039 Kernel: net: unbounded recursion in the vlan GRO processing mailing-list patch third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 93476 third-party-advisory vdb-entry
- RHSA-2017:0372 third-party-advisory vendor-advisory
- bto.bluecoat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- patchwork.ozlabs.org issue-tracking patch