CVE-2016-3135

What it actually does

Integer overflow in xt_alloc_table_info allows undersized allocation followed by out-of-bounds writes into heap memory when processing IPT_SO_SET_REPLACE setsockopt on 32-bit kernels, resulting in memory corruption that can be turned into privilege escalation or denial of service.

Why it matters to the business

Local attackers on 32-bit Linux systems can obtain root privileges or crash the host, enabling full host compromise or service disruption; the issue is long-public with public exploits available but no known ransomware or nation-state campaigns.

How an attack unfolds

An attacker with a local shell crafts a malicious IPT_SO_SET_REPLACE setsockopt call that supplies an oversized table size; the integer overflow in xt_alloc_table_info produces a too-small allocation, after which subsequent table data is written past the allocated buffer, corrupting adjacent heap structures and allowing control-flow hijacking or kernel panic.

How to fix it

Upgrade the kernel to a version containing commit d157bd761585605b7882935ffb86286919f62ea1 or later; rebuild and reboot with the patched kernel; on systems that cannot be immediately updated, restrict unprivileged local access and consider disabling unnecessary netfilter modules.

How to confirm the fix worked

Verify the running kernel contains commit d157bd761585605b7882935ffb86286919f62ea1 or is newer than 4.5.2; confirm xt_alloc_table_info no longer performs the vulnerable size calculation; run regression tests that exercise IPT_SO_SET_REPLACE with large table sizes.

Typical attack path

1. Obtain local shell on 32-bit Linux kernel <= 4.5.2
2. Open a netfilter socket and prepare a crafted ipt_replace structure with large num_entries and size values
3. Invoke setsockopt with IPT_SO_SET_REPLACE to trigger xt_alloc_table_info
4. Exploit resulting heap corruption to execute arbitrary kernel code or cause denial of service

How to detect it

Review audit logs for unusual setsockopt calls on netfilter sockets by unprivileged users; inspect kernel crash dumps for heap corruption signatures near x_tables allocations; correlate with any sudden privilege changes or unexpected root processes.

What your security team should do

• Patch all 32-bit Linux systems to the fixed commit immediately
• Audit local user access on remaining unpatched 32-bit hosts and apply compensating controls such as seccomp or user namespaces
• Monitor for future kernel updates and include this class of netfilter integer issues in patch-management SLAs