CVE Vulnerabilities

CVE-2016-10142

Published: Jan 14, 2017 | Modified: Apr 20, 2025
CVSS 3.x
8.6
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
5 MODERATE
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V3
5.8 MODERATE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Ubuntu
MEDIUM

An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed, unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned routers will themselves be the ones dropping their own traffic.

Affected Software

Name Vendor Start Version End Version
Ipv6 Ietf - (including) - (including)
Red Hat Enterprise Linux 6 RedHat kernel-0:2.6.32-696.el6 *
Linux Ubuntu bionic *
Linux Ubuntu esm-infra-legacy/trusty *
Linux Ubuntu focal *
Linux Ubuntu precise *
Linux Ubuntu trusty *
Linux Ubuntu trusty/esm *
Linux Ubuntu upstream *
Linux-armadaxp Ubuntu precise *
Linux-armadaxp Ubuntu upstream *
Linux-aws Ubuntu bionic *
Linux-aws Ubuntu focal *
Linux-aws Ubuntu upstream *
Linux-aws-5.15 Ubuntu focal *
Linux-aws-5.4 Ubuntu bionic *
Linux-aws-fips Ubuntu trusty *
Linux-aws-fips Ubuntu xenial *
Linux-aws-hwe Ubuntu xenial *
Linux-azure Ubuntu bionic *
Linux-azure Ubuntu esm-infra/bionic *
Linux-azure Ubuntu focal *
Linux-azure Ubuntu trusty *
Linux-azure Ubuntu trusty/esm *
Linux-azure Ubuntu xenial *
Linux-azure-4.15 Ubuntu bionic *
Linux-azure-5.15 Ubuntu focal *
Linux-azure-5.4 Ubuntu bionic *
Linux-azure-6.11 Ubuntu noble *
Linux-azure-fde Ubuntu esm-infra/focal *
Linux-azure-fde Ubuntu focal *
Linux-azure-fde-5.15 Ubuntu esm-infra/focal *
Linux-azure-fde-5.15 Ubuntu focal *
Linux-azure-fips Ubuntu trusty *
Linux-azure-fips Ubuntu xenial *
Linux-bluefield Ubuntu focal *
Linux-flo Ubuntu trusty *
Linux-flo Ubuntu upstream *
Linux-flo Ubuntu vivid/stable-phone-overlay *
Linux-flo Ubuntu xenial *
Linux-flo Ubuntu yakkety *
Linux-gcp Ubuntu bionic *
Linux-gcp Ubuntu esm-infra/bionic *
Linux-gcp Ubuntu focal *
Linux-gcp Ubuntu xenial *
Linux-gcp-4.15 Ubuntu bionic *
Linux-gcp-5.15 Ubuntu focal *
Linux-gcp-5.4 Ubuntu bionic *
Linux-gcp-6.11 Ubuntu noble *
Linux-gcp-fips Ubuntu trusty *
Linux-gcp-fips Ubuntu xenial *
Linux-gke Ubuntu esm-infra/focal *
Linux-gke Ubuntu focal *
Linux-gke Ubuntu upstream *
Linux-gkeop Ubuntu esm-infra/focal *
Linux-gkeop Ubuntu focal *
Linux-goldfish Ubuntu trusty *
Linux-goldfish Ubuntu upstream *
Linux-goldfish Ubuntu xenial *
Linux-goldfish Ubuntu yakkety *
Linux-goldfish Ubuntu zesty *
Linux-grouper Ubuntu trusty *
Linux-grouper Ubuntu upstream *
Linux-hwe Ubuntu bionic *
Linux-hwe Ubuntu esm-infra/bionic *
Linux-hwe Ubuntu upstream *
Linux-hwe-5.15 Ubuntu focal *
Linux-hwe-5.4 Ubuntu bionic *
Linux-hwe-6.11 Ubuntu noble *
Linux-hwe-edge Ubuntu bionic *
Linux-hwe-edge Ubuntu esm-infra/bionic *
Linux-hwe-edge Ubuntu upstream *
Linux-ibm Ubuntu focal *
Linux-ibm-5.15 Ubuntu focal *
Linux-ibm-5.4 Ubuntu bionic *
Linux-intel-iot-realtime Ubuntu jammy *
Linux-intel-iotg-5.15 Ubuntu focal *
Linux-iot Ubuntu focal *
Linux-kvm Ubuntu bionic *
Linux-kvm Ubuntu focal *
Linux-kvm Ubuntu xenial *
Linux-linaro-omap Ubuntu precise *
Linux-linaro-omap Ubuntu upstream *
Linux-linaro-shared Ubuntu precise *
Linux-linaro-shared Ubuntu upstream *
Linux-linaro-vexpress Ubuntu precise *
Linux-linaro-vexpress Ubuntu upstream *
Linux-lowlatency-hwe-5.15 Ubuntu focal *
Linux-lowlatency-hwe-6.11 Ubuntu noble *
Linux-lts-quantal Ubuntu precise *
Linux-lts-quantal Ubuntu precise/esm *
Linux-lts-quantal Ubuntu upstream *
Linux-lts-raring Ubuntu precise *
Linux-lts-raring Ubuntu precise/esm *
Linux-lts-raring Ubuntu upstream *
Linux-lts-saucy Ubuntu precise *
Linux-lts-saucy Ubuntu precise/esm *
Linux-lts-saucy Ubuntu upstream *
Linux-lts-trusty Ubuntu precise *
Linux-lts-trusty Ubuntu upstream *
Linux-lts-utopic Ubuntu trusty *
Linux-lts-utopic Ubuntu upstream *
Linux-lts-vivid Ubuntu upstream *
Linux-lts-wily Ubuntu trusty *
Linux-lts-wily Ubuntu upstream *
Linux-lts-xenial Ubuntu upstream *
Linux-maguro Ubuntu trusty *
Linux-maguro Ubuntu upstream *
Linux-mako Ubuntu trusty *
Linux-mako Ubuntu upstream *
Linux-mako Ubuntu vivid/stable-phone-overlay *
Linux-mako Ubuntu xenial *
Linux-mako Ubuntu yakkety *
Linux-manta Ubuntu trusty *
Linux-manta Ubuntu upstream *
Linux-nvidia-tegra-5.15 Ubuntu focal *
Linux-oracle Ubuntu bionic *
Linux-oracle Ubuntu focal *
Linux-oracle Ubuntu xenial *
Linux-oracle-5.15 Ubuntu focal *
Linux-oracle-5.4 Ubuntu bionic *
Linux-qcm-msm Ubuntu precise *
Linux-qcm-msm Ubuntu upstream *
Linux-raspi Ubuntu focal *
Linux-raspi-5.4 Ubuntu bionic *
Linux-raspi-realtime Ubuntu noble *
Linux-raspi2 Ubuntu bionic *
Linux-raspi2 Ubuntu esm-infra/focal *
Linux-raspi2 Ubuntu focal *
Linux-raspi2 Ubuntu upstream *
Linux-raspi2 Ubuntu vivid/ubuntu-core *
Linux-realtime Ubuntu jammy *
Linux-realtime Ubuntu noble *
Linux-riscv Ubuntu esm-infra/focal *
Linux-riscv Ubuntu focal *
Linux-riscv Ubuntu jammy *
Linux-riscv Ubuntu noble *
Linux-riscv-5.15 Ubuntu focal *
Linux-snapdragon Ubuntu bionic *
Linux-snapdragon Ubuntu upstream *
Linux-ti-omap4 Ubuntu precise *
Linux-ti-omap4 Ubuntu upstream *
Linux-xilinx-zynqmp Ubuntu focal *

References