The tcpchecksendhead function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcpxmitretransmitqueue use-after-free and system crash) via a crafted SACK option.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6828.json"
[
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"320508555297410187371225463763154946694",
"127016424457761731875022315049601893724",
"106163349812404842257709693086964721526",
"99546591510431973013931473399392849703"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@bb1fceca22492109be12640d49f5ea5a544c6bb4",
"id": "CVE-2016-6828-2d50d78c",
"target": {
"file": "include/net/tcp.h"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 135.0,
"function_hash": "120630578714289594267341456421072149128"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@bb1fceca22492109be12640d49f5ea5a544c6bb4",
"id": "CVE-2016-6828-892ea9e6",
"target": {
"file": "include/net/tcp.h",
"function": "tcp_check_send_head"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6828.json"
[
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 135.0,
"function_hash": "120630578714289594267341456421072149128"
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/bb1fceca22492109be12640d49f5ea5a544c6bb4",
"id": "CVE-2016-6828-193fc5e0",
"target": {
"file": "include/net/tcp.h",
"function": "tcp_check_send_head"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"320508555297410187371225463763154946694",
"127016424457761731875022315049601893724",
"106163349812404842257709693086964721526",
"99546591510431973013931473399392849703"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/bb1fceca22492109be12640d49f5ea5a544c6bb4",
"id": "CVE-2016-6828-df5be2a7",
"target": {
"file": "include/net/tcp.h"
}
}
]