A critical vulnerability in the Linux kernel has been fixed
This article is 9 years old — prices and terms may have changed.
A vulnerability in the Linux kernel with the identifier CVE-2016-10229 lets hackers gain control over a system — a personal computer, a server or a phone.
The vulnerability is dangerous for Linux kernel versions before 4.5. What makes it dangerous?
Attackers can execute arbitrary code remotely using UDP traffic that triggers an unsafe second checksum calculation during a recv() system call with the MSG_PEEK flag.
In other words, attackers can send the victim specially crafted packets that exploit the vulnerability by starting a second checksum calculation. That makes it possible to execute code in the kernel with superuser privileges.
The vulnerability was found comparatively long ago. Back in 2015 the security researcher Eric Dumazet found the problem in the kernel.
Since February 2017 Ubuntu and Debian have shipped with a fixed kernel. Google, for its part, has released a fix for Android. Red Hat says the vulnerability never affected its distribution.
Source http://www.securitylab.ru/