CVE-2016-9793

What it actually does

The sock_setsockopt function in net/core/sock.c mishandles negative values for sk_sndbuf and sk_rcvbuf, allowing local users with CAP_NET_ADMIN to trigger memory corruption or other kernel impact via crafted SO_SNDBUFFORCE or SO_RCVBUFFORCE setsockopt calls.

Why it matters to the business

Affected Linux systems risk local denial of service crashes or further compromise by privileged local users, causing operational downtime and potential loss of system availability on servers and endpoints running vulnerable kernels.

How an attack unfolds

A local attacker obtains a shell or process with CAP_NET_ADMIN, then issues a setsockopt system call supplying negative buffer sizes for the force options to corrupt kernel memory structures in socket handling.

How to fix it

Upgrade the Linux kernel to version 4.8.14 or later containing commit b98b0bc8c431e3ceb4b26b0dfc8db509518fb290; rebuild and reboot systems with the patched kernel.

How to confirm the fix worked

Confirm kernel version is 4.8.14+, verify the fix commit is present in net/core/sock.c, and test that setsockopt calls with valid non-negative buffer sizes succeed without corruption.

Typical attack path

1. Gain local access to a target Linux system
2. Escalate or obtain a process with CAP_NET_ADMIN capability
3. Invoke setsockopt with SO_SNDBUFFORCE or SO_RCVBUFFORCE and negative sk_sndbuf/sk_rcvbuf values
4. Trigger kernel memory corruption resulting in crash or potential privilege escalation

How to detect it

Inspect kernel logs for oops or panic messages referencing sock_setsockopt or buffer handling in net/core/sock.c; audit privileged process activity for unusual setsockopt invocations involving the force options.

• sock_setsockopt
• SO_SNDBUFFORCE
• SO_RCVBUFFORCE
• sk_sndbuf negative
• sk_rcvbuf negative
• net/core/sock.c

What your security team should do

• Apply the kernel update containing b98b0bc8c431e3ceb4b26b0dfc8db509518fb290 as the highest priority
• Limit CAP_NET_ADMIN grants to only essential processes and users
• Review and harden socket option usage in privileged code paths