CVE-2016-5696

Published: 6 August 2016

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.

From the Ubuntu Security Team

Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content into an TCP stream.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

fix is going to land in Ubuntu kernels in this SRU cycle,
with a likely release date of Aug 27. Earlier access to the kernels
with the fix will be available from the -proposed pocket, though they
come with the risk of being less tested.

Mitigation

Set the net.ipv4.tcp_challenge_ack_limit sysctl to some absurdly large
number (as described in the lwn article referenced above)

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5696
• https://www.mail-archive.com/netdev@vger.kernel.org/msg118677.html
• http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758
• https://lwn.net/Articles/696868/
• https://ubuntu.com/security/notices/USN-3072-1
• https://ubuntu.com/security/notices/USN-3072-2
• https://ubuntu.com/security/notices/USN-3070-1
• https://ubuntu.com/security/notices/USN-3071-2
• https://ubuntu.com/security/notices/USN-3071-1
• https://ubuntu.com/security/notices/USN-3070-4
• https://ubuntu.com/security/notices/USN-3070-3
• https://ubuntu.com/security/notices/USN-3070-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/bugs/1615835