Executive brief
A vulnerability was discovered in the Linux kernel's networking subsystem, specifically within the Enhanced Transmission Selection (ETS) scheduler. This component is responsible for managing how network traffic is prioritized and queued. An attacker with local access to the system could exploit this flaw to gain elevated privileges, potentially taking full control of the affected machine.
Technical details
An out-of-bounds (OOB) indexing vulnerability exists in the ets_class_from_arg() function within net/sched/sch_ets.c. The flaw is triggered when a class ID (clid) of 0 is passed to the function, causing an underflow when calculating the array index (arg - 1). This results in an extremely large index value (18446744073709551615) being used to access the 'ets_class' array. A local attacker can leverage this memory corruption to achieve local privilege escalation. The issue has been patched by adding bounds checking to ensure the argument is non-zero and within the valid range of bands.
Affected products
- Linux Linux Kernel 5.6 to 5.10.234, 5.11 to 5.15.178, 5.16 to 6.1.128, 6.2 to 6.6.75, 6.7 to 6.12.10, 6.13.1
Timeline
- 2025-01-11: patched: Initial patch submitted to kernel tree
- 2025-02-10: advisory: CVE-2025-21692 published
References
- https://git.kernel.org/stable/c/03c56665dab1f4ac844bc156652d50d639093fa5
- https://git.kernel.org/stable/c/1332c6ed446be787f901ed1064ec6a3c694f028a
- https://git.kernel.org/stable/c/997f6ec4208b23c87daf9f044689685f091826f7
- https://git.kernel.org/stable/c/bcf0d815e728a3a304b50455b32a3170c16e1eaa
- https://git.kernel.org/stable/c/d62b04fca4340a0d468d7853bd66e511935a18cb
- https://git.kernel.org/stable/c/f4168299e553f17aa2ba4016e77a9c38da40eb1d
- https://git.kernel.org/stable/c/f6b0f05fbfa4044f890e8a348288c0d9a20bd1d0