CVE-2016-8645

What it actually does

The TCP stack in the Linux kernel mishandles skb truncation during sendto system calls, triggering a kernel crash due to improper handling in net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c.

Why it matters to the business

Local users on affected Linux systems can trigger crashes that cause unplanned downtime, interrupt services, and require manual restarts or reboots.

How an attack unfolds

A local attacker develops or runs a crafted application that repeatedly invokes sendto system calls with specific parameters to exploit the skb truncation flaw and force a kernel panic.

How to fix it

Upgrade the Linux kernel to version 4.8.10 or later; apply the fix from commit ac6e780070e30e4c35bd395acfe9191e6268bdd3 in the torvalds/linux repository.

How to confirm the fix worked

Run uname -r to confirm kernel version 4.8.10 or newer; if building from source, verify the listed commit is present in the repository.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Create or deploy an application that issues crafted sendto calls targeting the TCP stack
3. Execute the application to trigger skb mishandling and induce a system crash

How to detect it

Inspect kernel crash logs and system messages for TCP stack panics involving skb truncation; monitor application behavior that generates unusual sendto activity leading to restarts.

What your security team should do

• Prioritize kernel upgrades on all affected Linux systems to the fixed version
• Limit local user privileges to reduce exposure to local denial-of-service flaws
• Review and test kernel updates in staging environments before production deployment