Description
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Kernel
Default version status: unaffected
3.8 to < 6.5affected
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64 ↗
- https://kernel.dance/3e337087c3b5805fe0b8a46ba622a962880b5d64 ↗
- https://www.debian.org/security/2023/dsa-5480 ↗
- https://security.netapp.com/advisory/ntap-20230908-0002/ ↗
- https://www.debian.org/security/2023/dsa-5492 ↗
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html ↗
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-769027.html ↗