Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially access sensitive memory. The issue exists in the 'sch_cake' component, which manages network traffic flow to ensure fairness between different users or devices. An attacker could exploit this to disrupt network operations or gain unauthorized access to information on the system.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the Linux kernel's Common Applications Kept Enhanced (CAKE) network scheduler (sch_cake.c). The root cause is a logic error that allows an underflow of per-host bulk flow fairness counters. When these counters underflow, they can be used as indices for memory access, leading to OOB access. The vulnerability can be triggered locally to cause a denial-of-service (system crash) or potentially leak kernel memory. The fix introduces helper functions that perform explicit bounds checking before incrementing or decrementing these counters.
Affected products
- Linux Linux Kernel 5.4.284 to 5.4.291, 5.10.226 to 5.10.235, 5.15.167 to 5.15.179, 6.1.110 to 6.1.125, 6.6.51 to 6.6.72, 6.11.1 to 6.12.10
Timeline
- 2025-01-07: patched: Initial patch submitted by Toke Høiland-Jørgensen
- 2025-01-19: disclosed: CVE-2025-21647 published
References
- https://git.kernel.org/stable/c/27202e2e8721c3b23831563c36ed5ac7818641ba
- https://git.kernel.org/stable/c/44fe1efb4961c1a5ccab16bb579dfc6b308ad58b
- https://git.kernel.org/stable/c/737d4d91d35b5f7fa5bb442651472277318b0bfd
- https://git.kernel.org/stable/c/91bb18950b88f955838ec0c1d97f74d135756dc7
- https://git.kernel.org/stable/c/a777e06dfc72bed73c05dcb437d7c27ad5f90f3f
- https://git.kernel.org/stable/c/b1a1743aaa4906c41c426eda97e2e2586f79246d
- https://git.kernel.org/stable/c/bb0245fa72b783cb23a9949c5048781341e91423