Hacker News Reader

Comment by codehusker | Hacker News Reader

It was assigned CVE-2016-9919. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9919

This all happened December 8th. I'm surprised this didn't make more noise, but it's unclear to me what versions are affected. It was reported on 4.8.12 and not marked as a regression, and was fixed during 4.9 development.

View on HN

It's normal not to make noise about security bugs. The CVE was issued almost two weeks after the fix landed in mainline. Surely the stable kernels were patched at the same time and the distros had pushed updates already.

Corollary: people writing exploits actively follow email lists such as this one for security issues.

Naturally they do.

I'm guessing this was intentionally handled quietly (though still in the open) until most people had already updated.

curious would this affect some consumer products that are ipv6 ready but dont ever get patched?

It'd be a relatively narrow window - it didn't affect RHEL 5/6/7 or the Ubuntu releases, so it'd need to be someone running a recent enough kernel to catch it but unmaintained enough to not push out the fixes.

Presuming this landed in 4.8 (guessing based on the kernels Debian listed fixes for versus not affected [1]), which came out in October 2016, that's 2 months of time when someone could have picked a stable release and gotten bitten by this.

update: it's actually even narrower, since it looks like those lines were added in a patch from November 3rd [2], so maybe a month.

[1] - https://security-tracker.debian.org/tracker/CVE-2016-9919

[2] - https://www.spinics.net/lists/netdev/msg402791.html

Kernel 4.8 won't be in many distros before years.

Kernel 4.8 will probably never be in distros, 4.9 is probably the LTS release they will use.

Reply on news.ycombinator.com