CVE-2016-3841: Use After Free
It was found that the Linux kernel's IPv6 implementation mishandles socket option data. A local attacker can abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.
Upstream patch:
https://github.com/torvalds/linux/commit/45f6fad84cc305103b28d73482b344d7f5b76f39
Other sources
The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-3841?
CVE-2016-3841 is a vulnerability in the IPv6 stack in the Linux kernel before version 4.3.3.
How does CVE-2016-3841 affect users?
CVE-2016-3841 allows local users to gain privileges or cause a denial of service through a crafted sendmsg system call.
What is the severity of CVE-2016-3841?
CVE-2016-3841 has a severity level of high.
How can I fix CVE-2016-3841?
To fix CVE-2016-3841, update the Linux kernel to version 4.3.3 or higher.
Where can I find more information about CVE-2016-3841?
You can find more information about CVE-2016-3841 at the following references: [link1], [link2], [link3].