Re: Any idea when CVE-2016-5696 is going to get fixed?

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.user
Subject	Re: Any idea when CVE-2016-5696 is going to get fixed?
Date	2016-08-29 07:30 +0200
Message-ID	<sbniW-3d6-17@gated-at.bofh.it> (permalink)
References	(2 earlier) <saCk2-7AH-9@gated-at.bofh.it> <sb7xw-1GT-27@gated-at.bofh.it> <sbjyF-M1-1@gated-at.bofh.it> <sblKa-26h-9@gated-at.bofh.it> <sbmZz-36K-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi,

On Mon, Aug 29, 2016 at 01:08:45AM -0400, Neal P. Murphy wrote:
> On Mon, 29 Aug 2016 03:43:15 +0000
> Mark Fletcher <mark27q1@gmail.com> wrote:
> 
> > Version 4.7 of the kernel contains a fix, which only required changes to
> > one source file, so I assume it's a question of back porting that fix into
> > the Jessie version of the kernel. I might take a look at trying that and
> > submit a patch if I can get it to work. (Now watch me trip over a dozen
> > issues I didn't think of when I try this)
> 
> Greg K-H backported the fix(es) to 3.14.76. And a fix to the fix in
> 3.14.77. And Ben H. has the patch in 3.16.37, which is likely closer
> to what you need). The patches involve increasing the limit to 1000
> ± some random factor, and per-socket rate limiting. It shouldn't be
> *too* difficult to backport that patch to Debian's kernel.

The issue is already been worked on by Ben for all versions in sid,
jessie (and wheezy lts):

sid:
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=sid&id=7184d7bfd94443b6403d71da639ec390224af594
(but then later just used as with 4.7.2 uploaded yesterday).

jessie:
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie-security&id=1bd5c3370523e5846019361b33a97c754db76f8d

wheezy:
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=wheezy-security&id=f383788fb866fc61daf26836bccd92ebf7a6f02f

HTH,

Regards,
Salvatore

Thread

Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 17:10 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 17:20 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-26 18:40 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 19:50 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-26 21:10 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-27 05:20 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "John T. Haggerty" <jpcookie@gmail.com> - 2016-08-27 05:30 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2016-08-27 17:50 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-28 14:40 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-28 21:40 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-28 23:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Tixy <tixy@yxit.co.uk> - 2016-08-29 13:00 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Gene Heskett <gheskett@shentel.net> - 2016-08-29 18:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-29 19:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 20:30 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-29 23:50 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 00:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Charlie <ariestao1@ipstarmail.com.au> - 2016-08-30 06:50 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 03:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-29 05:50 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 07:10 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Salvatore Bonaccorso <carnil@debian.org> - 2016-08-29 07:30 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200

csiph-web