Revision history [back]
 | 1 | initial version | posted 2017-05-19 11:52:41 +0200  |
fix use after free in tcp_xmit_retransmit_queue() in kernel-net-tcp CVE-2016-6828 critical
The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option. CVSSv3: 5.5 medium (attack range: local)
File affected: kernel-adaptation-sbj-3.4.108.20161101.1/include/net/tcp.h lines 1297-1302