Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to gain elevated privileges. The issue exists in how the system manages network packet queues when specific limits are set to zero. An attacker could exploit this logic error to cause internal inconsistencies in the kernel's memory or state, potentially leading to a full system takeover.
Technical details
A vulnerability in net/sched/sch_fifo.c exists where pfifo_tail_enqueue() fails to properly handle cases where sch->limit is set to 0. When a packet is enqueued to a scheduler with a zero limit, the 'drop' step is skipped if the queue is empty, but the subsequent 'enqueue' step still increments the queue length (qlen). This creates a mismatch between parent and child Qdisc queue lengths, as the parent Qdisc does not increment its qlen due to receiving a NET_XMIT_CN status code. This state inconsistency can be leveraged by a local attacker for user-to-kernel privilege escalation. Patches have been released across multiple stable kernel branches to ensure packets are immediately dropped when the limit is zero.
Affected products
- Linux Linux Kernel 2.6.34 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.130, 6.2 to 6.6.83, 6.7 to 6.12.14, 6.13 to 6.13.3
Timeline
- 2025-02-03: patched: Initial patch authored
- 2025-02-18: advisory: CVE-2025-21702 published
References
- https://git.kernel.org/stable/c/020ecb76812a0526f4130ab5aeb6dc7c773e7ab9
- https://git.kernel.org/stable/c/647cef20e649c576dff271e018d5d15d998b629d
- https://git.kernel.org/stable/c/78285b53266d6d51fa4ff504a23df03852eba84e
- https://git.kernel.org/stable/c/79a955ea4a2e5ddf4a36328959de0de496419888
- https://git.kernel.org/stable/c/7a9723ec27aff5674f1fd4934608937f1d650980
- https://git.kernel.org/stable/c/a56a6e8589a9b98d8171611fbcc1e45a15fd2455
- https://git.kernel.org/stable/c/b6a079c3b6f95378f26e2aeda520cb3176f7067b