CVE-2016-8632

Published: 11/28/2016 Last updated: 8/6/2024 Reserved: 10/12/2016

The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Opam packages affected (27)

albatross cdrom conf-bpftool conf-libbpf conf-linux-libc-dev core core_unix hvsock mirage-block-unix mm ocaml-probes orun rawlink rawlink-eio rawlink-lwt shell solo5 solo5-bindings-hvt solo5-bindings-spt solo5-cross-aarch64 solo5-kernel-ukvm tracy-client tuntap uring vhd-format vhd-format-lwt xapi-stdext-unix

Products affected (1)

Product	Vendor	Version
n/a	n/a	1.6.24

References (8)

http://www.openwall.com/lists/oss-security/2016/11/08/5
https://bugzilla.redhat.com/show_bug.cgi?id=1390832
http://www.securityfocus.com/bid/94211
https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
http://www.openwall.com/lists/oss-security/2016/11/08/5
https://bugzilla.redhat.com/show_bug.cgi?id=1390832
http://www.securityfocus.com/bid/94211
https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html