CVE-2016-10200

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.8.14

Description A race condition exists in the L2TPv3 IP Encapsulation feature, allowing local users to gain privileges or cause a denial of service. This issue is related to the net/l2tp/l2tp ip.c and net/l2tp/l2tp ip6.c files. The problem occurs when multiple bind system calls are made without properly checking whether a socket has the SOCK ZAPPED status, resulting in a use-after-free condition.

Recommendations For Linux kernel versions prior to 4.8.14, update to version 4.8.14 or later to resolve the issue.