Today I was reading about the potential impact of CVE-2016-5696 in Android phones running Linux 3.6+ and though my phone has 3.4 I checked the value of net.ipv4.tcp_challenge_ack_limit and it is also 100, as it is in my OpenVZ VPS running kernel 2.6.32.My question is, what does exactly determine if a system is vulnerable apart from that parameter? Has it been widely backported to older kernel versions?
Are devices with kernels below 3.6 vulnerable to CVE-2016-5696?
security;linux kernel;android