Bug 10139

Summary: CVE-2016-5696 kernel: challenge ACK counter information disclosure.
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: kernelAssignee: Bruce Ashfield <bruce.ashfield>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: High CC: sgw, tom.zanussi
Version: unspecified   
Target Milestone: 2.2 M3   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Sona Sarmadi 2016-08-14 17:57:26 UTC 
A flaw was found in the implementation of the Linux kernels handling of
networking challenge ack where an attacker is able to determine the
shared counter.

This may allow an attacker to inject or take over a TCP connection between
a server and client without having to be a traditional Man In the Middle (MITM) style attack.

OSS-Security post:
http://seclists.org/oss-sec/2016/q3/44

Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758

This is currently only fixed in mainline kernels (4.8 & 4.7): 

https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758 



Introduced in (tcp: implement RFC 5961 3.2):
 https://github.com/torvalds/linux/commit/282f23c6ee343126156dd41218b22ece96d747e3 (v3.6)
Comment 1 Bruce Ashfield 2016-08-15 01:21:13 UTC 
This will be fixed when it loops around via -stable. 

We aren't going to start cherry picking CVE fixes now, the policy is to get them via -stable.

If someone wants them faster, they pay a OSV :)
Comment 2 Sona Sarmadi 2016-08-15 07:41:29 UTC 
ok, good. Stable kernels will be updated soon:

> 
> I just added the fix for this issue to the stable kernel queues and it 
> will show up in the next stable releases, in about 2 days after it 
> passes all of the needed review.
> 
> Hope this helps,
> 
> greg k-h
Comment 3 Sona Sarmadi 2016-08-19 08:01:21 UTC 
4.4.18 version is released: 

commit e4884275a4bb1cbce5a24a507c3e267c887dc1bd
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Aug 16 09:31:54 2016 +0200

    Linux 4.4.18

Can you please update linux-yocto to 4.4.18 to address this vulnerability?
http://git.yoctoproject.org/cgit/cgit.cgi/linux-yocto-4.4/log/fs?h=standard/base
Merge tag 'v4.4.16' into standard/base
Comment 4 Bruce Ashfield 2016-08-19 12:41:00 UTC 
4.4.18 is already queued and under test. When that passes, the pull requests will be sent.
Comment 5 Bruce Ashfield 2016-09-02 17:24:21 UTC 
merged korg 4.1.18+ to pick up the change.