CVE-2016-3156: Medium severity suse linux enterprise software development kit vulnerability
Destroy of network interface with huge number of ipv4 addresses keeps rtnllock for a very long time (up to hour). It blocks many network related operations, including for example creation of new incoming ssh connections.
The problem is especially important for containers, container owner have enough permission to enable this trigger and then can block network access on whole host node.
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git/commit/?id=fbd40ea0180a2d328c5adc61414dc8bab9335ce2
References:
http://seclists.org/oss-sec/2016/q1/643
CVE assignment:
http://seclists.org/oss-sec/2016/q1/647
Other sources
The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3156?
CVE-2016-3156 carries a medium severity rating due to its impact on network operations.
How do I fix CVE-2016-3156?
To mitigate CVE-2016-3156, upgrading to the patched versions of kernel packages is recommended.
Which systems are affected by CVE-2016-3156?
CVE-2016-3156 affects various versions of SUSE Linux Enterprise and Ubuntu Linux among others.
What type of vulnerability is CVE-2016-3156?
CVE-2016-3156 is a vulnerability that causes prolonged locking of the rtnl_lock, affecting network functions.
What are the consequences of CVE-2016-3156?
The consequences of CVE-2016-3156 include the blocking of network operations like SSH connections, especially in container environments.