A flaw was found in the implementation of the Linux kernels handling of networking challenge ack where an attacker is able to determine the shared counter. This may allow an attacker to inject or take over a TCP connection between a server and client without having to be a traditional Man In the Middle (MITM) style attack. OSS-Security post: http://seclists.org/oss-sec/2016/q3/44 Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758 This is currently only fixed in mainline kernels (4.8 & 4.7): https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758 Introduced in (tcp: implement RFC 5961 3.2): https://github.com/torvalds/linux/commit/282f23c6ee343126156dd41218b22ece96d747e3 (v3.6)
This will be fixed when it loops around via -stable. We aren't going to start cherry picking CVE fixes now, the policy is to get them via -stable. If someone wants them faster, they pay a OSV :)
ok, good. Stable kernels will be updated soon: > > I just added the fix for this issue to the stable kernel queues and it > will show up in the next stable releases, in about 2 days after it > passes all of the needed review. > > Hope this helps, > > greg k-h
4.4.18 version is released: commit e4884275a4bb1cbce5a24a507c3e267c887dc1bd Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Date: Tue Aug 16 09:31:54 2016 +0200 Linux 4.4.18 Can you please update linux-yocto to 4.4.18 to address this vulnerability? http://git.yoctoproject.org/cgit/cgit.cgi/linux-yocto-4.4/log/fs?h=standard/base Merge tag 'v4.4.16' into standard/base
4.4.18 is already queued and under test. When that passes, the pull requests will be sent.
merged korg 4.1.18+ to pick up the change.