Vulnerability Details CVE-2016-9919
The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.055
EPSS Ranking 90.1%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 7.8
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2
- http://www.openwall.com/lists/oss-security/2016/12/08/15
- http://www.securityfocus.com/bid/94824
- https://github.com/torvalds/linux/commit/79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2
- http://www.openwall.com/lists/oss-security/2016/12/08/15
- http://www.securityfocus.com/bid/94824
- https://github.com/torvalds/linux/commit/79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2
Products affected by CVE-2016-9919
-
cpe:2.3:o:linux:linux_kernel:4.4.223
-
cpe:2.3:o:linux:linux_kernel:4.8.10
-
cpe:2.3:o:linux:linux_kernel:4.8.11
-
cpe:2.3:o:linux:linux_kernel:4.8.12
-
cpe:2.3:o:linux:linux_kernel:4.8.13
-
cpe:2.3:o:linux:linux_kernel:4.8.14
-
cpe:2.3:o:linux:linux_kernel:4.8.15
-
cpe:2.3:o:linux:linux_kernel:4.8.16
-
cpe:2.3:o:linux:linux_kernel:4.8.17
-
cpe:2.3:o:linux:linux_kernel:4.9