This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10200 →

DEBIAN-CVE-2016-10200

Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of ser...

Original description

The description as published by the source.

Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.15-1"}]}]

Debian:13 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.15-1"}]}]

Debian:14 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.15-1"}]}]

References

advisory security-tracker.debian.org