udp.c in the Linux kernel prior to 4.5 allows remote malicious users to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
linux linux kernel |
||
google android |
Ping of pwn: Malicious UDP packets may take over gear
A Linux kernel flaw that potentially allows miscreants to remotely control vulnerable servers, desktops, IoT gear, Android handhelds, and more, has been quietly patched. The programming blunder – CVE-2016-10229 – exposes machines and gizmos to attacks via UDP network traffic: any software receiving data using the system call recv() with the MSG_PEEK flag set on a vulnerable kernel opens up the box to potential hijacking. The hacker would have to craft packets to trigger a second checksum ope...
Vulmon