10139 2016-08-14 17:57:26 +0000 CVE-2016-5696 kernel: challenge ACK counter information disclosure. 2016-09-02 17:24:21 +0000 1 1 7 Build System, Metadata & Runtime OE-Core kernel unspecified All Multiple RESOLVED FIXED High major 2.2 M3 1 sona.sarmadi bruce.ashfield sgw tom.zanussi --- --- No (bug/feature does not impact docs) oldest_to_newest 65176 0 sona.sarmadi 2016-08-14 17:57:26 +0000 A flaw was found in the implementation of the Linux kernels handling of networking challenge ack where an attacker is able to determine the shared counter. This may allow an attacker to inject or take over a TCP connection between a server and client without having to be a traditional Man In the Middle (MITM) style attack. OSS-Security post: http://seclists.org/oss-sec/2016/q3/44 Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758 This is currently only fixed in mainline kernels (4.8 & 4.7): https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758 Introduced in (tcp: implement RFC 5961 3.2): https://github.com/torvalds/linux/commit/282f23c6ee343126156dd41218b22ece96d747e3 (v3.6) 65177 1 bruce.ashfield 2016-08-15 01:21:13 +0000 This will be fixed when it loops around via -stable. We aren't going to start cherry picking CVE fixes now, the policy is to get them via -stable. If someone wants them faster, they pay a OSV :) 65182 2 sona.sarmadi 2016-08-15 07:41:29 +0000 ok, good. Stable kernels will be updated soon: > > I just added the fix for this issue to the stable kernel queues and it > will show up in the next stable releases, in about 2 days after it > passes all of the needed review. > > Hope this helps, > > greg k-h 65339 3 sona.sarmadi 2016-08-19 08:01:21 +0000 4.4.18 version is released: commit e4884275a4bb1cbce5a24a507c3e267c887dc1bd Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Date: Tue Aug 16 09:31:54 2016 +0200 Linux 4.4.18 Can you please update linux-yocto to 4.4.18 to address this vulnerability? http://git.yoctoproject.org/cgit/cgit.cgi/linux-yocto-4.4/log/fs?h=standard/base Merge tag 'v4.4.16' into standard/base 65349 4 bruce.ashfield 2016-08-19 12:41:00 +0000 4.4.18 is already queued and under test. When that passes, the pull requests will be sent. 65773 5 bruce.ashfield 2016-09-02 17:24:21 +0000 merged korg 4.1.18+ to pick up the change.