CVE-2016-8666: High severity linux kernel vulnerability
Remotely triggerable unbounded recursion in GRE code was found. If a packet has the layout: IPv4 header | GRE header | IPv4 header | GRE header | ... depending on left over stack, it could run the kernel out of stack due to recursion and so crash the kernel.
Reproducer:
https://bugzilla.suse.com/showbug.cgi?id=1001486#c5 https://bugzilla.suse.com/attachment.cgi?id=695327
Discussion threads:
https://marc.info/?t=145920955700002&r=1&w=2 https://marc.info/?t=145928865300005&r=1&w=2
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971
CVE request+assignment:
http://seclists.org/oss-sec/2016/q4/121 http://seclists.org/oss-sec/2016/q4/125
Other sources
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8666?
CVE-2016-8666 has been classified as high severity due to its potential to crash the kernel through unbounded recursion.
How do I fix CVE-2016-8666?
To mitigate CVE-2016-8666, upgrade to a patched version of the Linux kernel that addresses the vulnerability.
What versions of Linux are affected by CVE-2016-8666?
CVE-2016-8666 affects Linux kernel versions from 3.14 to 4.6, including specific ranges of 3.16, 3.18, 4.1, and 4.4.
What impact does CVE-2016-8666 have on my system?
CVE-2016-8666 can lead to kernel crashes resulting in a denial of service, impacting system availability.
Is CVE-2016-8666 exploitable remotely?
Yes, CVE-2016-8666 can be remotely triggered through specially crafted GRE packets.