6 ms·

It was assigned CVE-2016-9919. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9919 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9919 This a

It was assigned CVE-2016-9919. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9919 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9919 This all happened December 8th. I'm surprised this didn't make more noise, but it's unclear to me what versions are affected. It was reported on 4.8.12 and not marked as a regression, and was fixed during 4.9 development.

derefr 10y ago
I'm guessing this was intentionally handled quietly (though still in the open) until most people had already updated.
- rmkbow 10y ago
  curious would this affect some consumer products that are ipv6 ready but dont ever get patched?
  - rincebrain 10y ago
    It'd be a relatively narrow window - it didn't affect RHEL 5/6/7 or the Ubuntu releases, so it'd need to be someone running a recent enough kernel to catch it but unmaintained enough to not push out the fixes. Presuming this landed in 4.8 (guessing based on the kernels Debian listed fixes for versus not affected [1]), which came out in October 2016, that's 2 months of time when someone could have picked a stable release and gotten bitten by this. update: it's actually even narrower, since it looks like those lines were added in a patch from November 3rd [2], so maybe a month. [1] - https://security-tracker.debian.org/tracker/CVE-2016-9919 https://security-tracker.debian.org/tracker/CVE-2016-9919 [2] - https://www.spinics.net/lists/netdev/msg402791.html https://www.spinics.net/lists/netdev/msg402791.html
  - Thaxll 10y ago
    Kernel 4.8 won't be in many distros before years.
    - justincormack 10y ago
      Kernel 4.8 will probably never be in distros, 4.9 is probably the LTS release they will use.
ajross 10y ago
It's normal not to make noise about security bugs. The CVE was issued almost two weeks after the fix landed in mainline. Surely the stable kernels were patched at the same time and the distros had pushed updates already.
- alpb 10y ago
  Corollary: people writing exploits actively follow email lists such as this one for security issues.
  - mfukar 10y ago
    Naturally they do.

derefr 10y ago

I'm guessing this was intentionally handled quietly (though still in the open) until most people had already updated.

rmkbow 10y ago
curious would this affect some consumer products that are ipv6 ready but dont ever get patched?
- rincebrain 10y ago
  It'd be a relatively narrow window - it didn't affect RHEL 5/6/7 or the Ubuntu releases, so it'd need to be someone running a recent enough kernel to catch it but unmaintained enough to not push out the fixes. Presuming this landed in 4.8 (guessing based on the kernels Debian listed fixes for versus not affected [1]), which came out in October 2016, that's 2 months of time when someone could have picked a stable release and gotten bitten by this. update: it's actually even narrower, since it looks like those lines were added in a patch from November 3rd [2], so maybe a month. [1] - https://security-tracker.debian.org/tracker/CVE-2016-9919 https://security-tracker.debian.org/tracker/CVE-2016-9919 [2] - https://www.spinics.net/lists/netdev/msg402791.html https://www.spinics.net/lists/netdev/msg402791.html
- Thaxll 10y ago
  Kernel 4.8 won't be in many distros before years.
  - justincormack 10y ago
    Kernel 4.8 will probably never be in distros, 4.9 is probably the LTS release they will use.

ajross 10y ago

It's normal not to make noise about security bugs. The CVE was issued almost two weeks after the fix landed in mainline. Surely the stable kernels were patched at the same time and the distros had pushed updates already.

alpb 10y ago
Corollary: people writing exploits actively follow email lists such as this one for security issues.
- mfukar 10y ago
  Naturally they do.