Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly manages network traffic queues, leading to memory corruption. This could impact the stability and security of servers and workstations running affected versions of Linux.
Technical details
A use-after-free (UAF) vulnerability exists in net/sched/sch_api.c within the qdisc_tree_reduce_backlog function. The root cause is a flawed assumption that Qdiscs with a major handle of ffff: are always root or ingress; however, it is valid to create egress qdiscs with this handle. When certain qdiscs like Deficit Round Robin (DRR) maintain an active class list, this logic error leads to a dangling class pointer. An attacker with local access can exploit this by manipulating network queueing disciplines to trigger the UAF. Patches have been released across multiple stable kernel branches to ensure iteration stops correctly at TC_H_ROOT.
Affected products
- Linux Linux Kernel 2.6.25 to 4.19.323, 4.20 to 5.4.285, 5.5 to 5.10.229, 5.11 to 5.15.171, 5.16 to 6.1.116, 6.2 to 6.6.60, 6.7 to 6.11.7, 6.12-rc1 to 6.12-rc5
Timeline
- 2024-11-19: advisory: Initial disclosure and NVD publication
- 2024-10-29: patched: Mainline kernel patch committed
References
- https://git.kernel.org/stable/c/05df1b1dff8f197f1c275b57ccb2ca33021df552
- https://git.kernel.org/stable/c/2e95c4384438adeaa772caa560244b1a2efef816
- https://git.kernel.org/stable/c/580b3189c1972aff0f993837567d36392e9d981b
- https://git.kernel.org/stable/c/597cf9748c3477bf61bc35f0634129f56764ad24
- https://git.kernel.org/stable/c/9995909615c3431a5304c1210face5f268d24dba
- https://git.kernel.org/stable/c/ce691c814bc7a3c30c220ffb5b7422715458fd9b
- https://git.kernel.org/stable/c/dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20