CVE-2016-5696: Infoleak
A flaw was found in the implementation of the Linux kernels handling of networking challenge ack where an attacker is able to determine the shared counter.
This may allow an attacker located on different subnet to inject or take over a TCP connection between a server and client without having to be a traditional Man In the Middle (MITM) style attack.
OSS-Security post: http://seclists.org/oss-sec/2016/q3/44
Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758
Other sources
net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
— Launchpad
Affected Software
Remediation
Mitigation
Event History
Frequently Asked Questions
What is CVE-2016-5696?
CVE-2016-5696 is a vulnerability in the Linux kernel before version 4.7 that allows remote attackers to hijack TCP sessions via a blind in-window attack.
How does CVE-2016-5696 affect Linux?
CVE-2016-5696 affects the Linux kernel versions before 4.7, making it vulnerable to remote attackers who can hijack TCP sessions.
How severe is CVE-2016-5696?
CVE-2016-5696 is considered a high severity vulnerability with a severity value of 7.
Which software versions are affected by CVE-2016-5696?
Linux kernel versions before 4.7, such as 3.2.0-1672.98, are affected by CVE-2016-5696.
Is there a fix available for CVE-2016-5696?
Yes, updating the Linux kernel to version 4.7 or later will fix the vulnerability.