CVE-2016-8655 Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability...
HighCVSS 7.8
EPSS 11.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.8.15-1 | 4.8.15-1 |
| debian/linux(Debian:13) | < 4.8.15-1 | 4.8.15-1 |
| debian/linux(Debian:14) | < 4.8.15-1 | 4.8.15-1 |
| Linux kernel | >= 3.2, < 3.2.85 | 3.2.85 |
| Linux kernel | >= 3.3, < 3.10.106 | 3.10.106 |
| Linux kernel | >= 3.11, < 3.12.69 | 3.12.69 |
| Linux kernel | >= 3.13, < 3.16.40 | 3.16.40 |
| Linux kernel | >= 3.17, < 3.18.46 | 3.18.46 |
| Linux kernel | >= 3.19, < 4.1.37 | 4.1.37 |
| Linux kernel | >= 4.2, < 4.4.38 | 4.4.38 |
| Linux kernel | >= 4.5, < 4.8.14 | 4.8.14 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.10 | No fix listed |
References
- Debian Security Tracker CVE-2016-8655 vendor-advisory
- git.kernel.org patch vendor-advisory
- SUSE-SU-2016:3096 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3113 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3116 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3117 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3169 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3183 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3197 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3205 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3206 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:3247 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- RHSA-2017:0386 third-party-advisory vendor-advisory
- RHSA-2017:0387 third-party-advisory vendor-advisory
- RHSA-2017:0402 third-party-advisory vendor-advisory
- [oss-security] 20161206 CVE-2016-8655 Linux af_packet.c race condition (local root) mailing-list third-party-advisory
- 94692 third-party-advisory vdb-entry
- 1037403 third-party-advisory vdb-entry
- 1037968 third-party-advisory vdb-entry
- USN-3149-1 third-party-advisory vendor-advisory
- USN-3149-2 third-party-advisory vendor-advisory
- USN-3150-1 third-party-advisory vendor-advisory
- USN-3150-2 third-party-advisory vendor-advisory
- USN-3151-1 third-party-advisory vendor-advisory
- USN-3151-2 third-party-advisory vendor-advisory
- USN-3151-3 third-party-advisory vendor-advisory
- USN-3151-4 third-party-advisory vendor-advisory
- USN-3152-1 third-party-advisory vendor-advisory
- USN-3152-2 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- github.com patch third-party-advisory
- source.android.com third-party-advisory
- 40871 exploit third-party-advisory vdb-entry
- 44696 exploit third-party-advisory vdb-entry