Today I was reading about the potential impact of CVE-2016-5696 in Android phones running Linux 3.6+ and though my phone has 3.4 I checked the value of net.ipv4.tcp_challenge_ack_limit and it is also 100, as it is in my OpenVZ VPS running kernel 2.6.32.

My question is, what does exactly determine if a system is vulnerable apart from that parameter? Has it been widely backported to older kernel versions?

1 Answer 1


It should affect only Android version 4.4 or higher. According to http://www.heise.de/newsticker/meldung/HTTP-Verbindungen-von-einer-Milliarde-Android-Geraeten-angreifbar-3300328.html one can check if one is vulnerable if sysctl net.ipv4.tcp_challenge_ack_limit gives a value back that is less than 1000, so your device is vulnerable.

  • 1
    I'm actually running Marshmallow with monthly security patches (CM13). Aug 17, 2016 at 10:00
  • CM is another thing. If it is affected, expect updates shortly. The bug was introduced in kernel 3.06. Redhat backported it access.redhat.com/security/cve/cve-2016-5696 . If it was backported by CM, you would need to ask them, or just wait a little bit and it will resolve itself. Aug 17, 2016 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.