CVE-2016-8655: canonical ubuntu_linux
Vulnerability summary
CVE-2016-8655 is a high (CVSS 7.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 11.13% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 4 public exploits are recorded.
Weaponized exploit (exploit-database, 22-05-2018)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 30 · Related 24Timeline
- 08-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
11.13%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 11.13% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
4 foundLinux 4.4.0 < 4.4.0-53 - 'AF_PACKET chocobo_root' Local Privilege Escalation (Metasploit)
Maturity: weaponized
Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation
Maturity: weaponized
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation
Maturity: poc
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat15 products
- kernel-rt< 1:3.10.0-514.rt56.215.el6rt
- kernel-rt-debug< 1:3.10.0-514.rt56.215.el6rt
- kernel-rt-debug-debuginfo< 1:3.10.0-514.rt56.215.el6rt
- kernel-rt-debug-devel< 1:3.10.0-514.rt56.215.el6rt
- kernel-rt-debuginfo< 1:3.10.0-514.rt56.215.el6rt
Ubuntu5 products
- linux< 3.13.0-105.152 | < 4.4.0-53.74
- linux-lts-vivid< 3.19.0-77.85~14.04.1
- linux-lts-xenial< 4.4.0-53.74~14.04.1
- linux-raspi2< 4.4.0-1034.41
- linux-snapdragon< 4.4.0-1039.43
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 16.10
Debian1 product
- linux< 4.8.15-1
Linux1 product
- linux_kernel≥ 3.2, < 3.2.85 | ≥ 3.3, < 3.10.106 | ≥ 3.11, < 3.12.69 | ≥ 3.13, < 3.16.40 | ≥ 3.17, < 3.18.46 | ≥ 3.19, < 4.1.37 | ≥ 4.2, < 4.4.38 | ≥ 4.5, < 4.8.14
5 vendors · 23 products
References
54 links- lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- github.com/torvalds/linux/commit/84ac7260236a49c79eede91617700174c2c19b0cX Refsource CONFIRMPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00077.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00067.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 54 references
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00056.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00073.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1400019X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB EntryREPORT
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00087.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00070.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00055.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-12/msg00076.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
