Warning : TCP Stack Vulnerability in the Linux Kernel (CVE-2016-5696)

Researchers at the University of California have identified a dangerous vulnerability in the TCP (Transmission Control Protocol) used by Linux. The finding of flaw dates back to the end of 2012 but was discovered only recently. They are working with the community for some preventive measures (like an update for clients and hosts) as a pending official patch. The TCP protocol adopted by Linux is affected by a vulnerability that allows you to enter in communications between client and server. This Article Gives Information About TCP Stack Vulnerability in the Linux Kernel For the End Users including Android Mobile Phone Users.

 

TCP Stack Vulnerability in the Linux Kernel (CVE-2016-5696) : Spectrum Could Spy on Tor Too

 

Linux kernel is widely used in heterogeneous environments including hosting services, cloud, mobile phones, televisions etc and the flaw is considerable as a threat to a large number of users. The vulnerability theoretically able to hack remote communications using the exploit Internet to monitor a user’s online activities, close communication, introducing malicious code in a forced manner like injection or intercept the information exchanged between client and host, make it less effective solutions that guarantee online anonymity in case of Tor. Even HTTPS with connections, which although immune to injection practices, data can be can be theft by running exploit via this vulnerability.

 

TCP Stack Vulnerability in the Linux Kernel : Side Channel Attack

 

The vulnerability allows to deduce the sequence of numbers associated with a particular connection based on the IP addresses of the communicating parties. In practice, given the IP address of any two machines present on the net, one can slide into their communication channel to perform various operations. The attack is fast and reliable, the researchers gave note, because it takes less than 60 seconds to be completed and has a success rate close to 90%.
Some of the security experts have pointed out that this vulnerability references to popular side channel attacks (an approach that, rather than relying on the traditional method “brute force” , try to get information from flaws arising from the implementation of a certain measure of security) 90s. The flaw allows man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. TCP protocol is the heart of all Internet communications, as all application level protocols, including HTTP, FTP, SSH, Telnet, DNS, and SMTP, stand on TCP.

 

Temporary Fix of TCP Stack Vulnerability (by Akamai)

 

You can see the Linux Kernel’s detection and patch on Github :

As a workaround while patches to fix the problem are prepared and distributed, you can raise the rate limit on your Linux machine or gadget to make it more difficult for an attacker to be successful. Check :

You can add this on /etc/sysctl.conf :

or run :

Reload sysctl to activate the new rule.

 

Official Information on CVE-2016-5696

 

Tagged With paperuri:(04ce863cf8693fdd58f7e96e15c3dab1) , TCP SACK kernel vulnarabilities , ubuntu a vulnerability found in the TCP stack management in the Linux kernel