Re: Any idea when CVE-2016-5696 is going to get fixed?
On Mon, 29 Aug 2016 03:43:15 +0000
Mark Fletcher <mark27q1@gmail.com> wrote:
> Version 4.7 of the kernel contains a fix, which only required changes to
> one source file, so I assume it's a question of back porting that fix into
> the Jessie version of the kernel. I might take a look at trying that and
> submit a patch if I can get it to work. (Now watch me trip over a dozen
> issues I didn't think of when I try this)
Greg K-H backported the fix(es) to 3.14.76. And a fix to the fix in 3.14.77. And Ben H. has the patch in 3.16.37, which is likely closer to what you need). The patches involve increasing the limit to 1000 ± some random factor, and per-socket rate limiting. It shouldn't be *too* difficult to backport that patch to Debian's kernel.
Reply to: