Executive brief
A vulnerability in the Linux kernel's network traffic scheduling component could allow a local user to crash the system. By configuring a specific network queueing rule with an invalid packet limit, an attacker can trigger an internal error that leads to a system crash (denial of service). This affects the reliability and availability of the operating system.
Technical details
An out-of-bounds array access vulnerability exists in net/sched/sch_sfq.c within the Linux kernel. The root cause is an improper validation of the 'limit' parameter in the Stochastic Fairness Queueing (SFQ) scheduler; specifically, a limit of 1 packet causes an internal underflow of the queue length (qlen) during dequeue operations. This underflow leads to an out-of-bounds index access in the 'sfq_head' structure, resulting in a kernel crash (UBSAN: array-index-out-of-bounds). The attack requires local privileges to configure network traffic control (tc) settings. Patches have been released for various stable kernel branches to enforce a minimum limit check.
Affected products
- Linux Linux kernel All versions prior to 2024-12-05 patches
Timeline
- 2024-12-05: patched: Initial patch committed to Linux stable tree
- 2025-02-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/10685681bafce6febb39770f3387621bf5d67d0b
- https://git.kernel.org/stable/c/1b562b7f9231432da40d12e19786c1bd7df653a7
- https://git.kernel.org/stable/c/1e6d9d87626cf89eeffb4d943db12cb5b10bf961
- https://git.kernel.org/stable/c/35d0137305ae2f97260a9047f445bd4434bd6cc7
- https://git.kernel.org/stable/c/7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4
- https://git.kernel.org/stable/c/7fefc294204f10a3405f175f4ac2be16d63f135e
- https://git.kernel.org/stable/c/833e9a1c27b82024db7ff5038a51651f48f05e5e