Description
In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 to < e395fec75ac2dbffc99b4bce57b7f1f3c5449f2caffected216509dda290f6db92c816dd54b83c1df9da9e76 to < 7f31d74fcc556a9166b1bb20515542de7bb939d1affectedc2047b0e216c8edce227d7c42f99ac2877dad0e4 to < 98a2c685293aae122f688cde11d9334dddc5d207affected10df49cfca73dfbbdb6c4150d859f7e8926ae427 to < 7b79ca9a1de6a428d486ff52fb3d602321c08f55affected3824c5fad18eeb7abe0c4fc966f29959552dca3e to < 1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5affected356078a5c55ec8d2061fcc009fb8599f5b0527f9 to < 6312555249082d6d8cc5321ff725df05482d8b83affectedf8d4bc455047cf3903cd6f85f49978987dbb3027 to < 839ecc583fa00fab785fde1c85a326743657fd32affectedf8d4bc455047cf3903cd6f85f49978987dbb3027 to < 638ba5089324796c2ee49af10427459c2de35f71affected5.4.288 to < 5.4.291affected5.10.232 to < 5.10.235affected5.15.175 to < 5.15.179affected6.1.121 to < 6.1.129affected6.6.67 to < 6.6.78affected6.12.6 to < 6.12.14affected
Linux Linux
Default version status: affected
6.13affected0 to < 6.13unaffected5.4.291 to ≤ 5.4.*unaffected5.10.235 to ≤ 5.10.*unaffected5.15.179 to ≤ 5.15.*unaffected6.1.129 to ≤ 6.1.*unaffected6.6.78 to ≤ 6.6.*unaffected6.12.14 to ≤ 6.12.*unaffected6.13.3 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e395fec75ac2dbffc99b4bce57b7f1f3c5449f2c ↗
- https://git.kernel.org/stable/c/7f31d74fcc556a9166b1bb20515542de7bb939d1 ↗
- https://git.kernel.org/stable/c/98a2c685293aae122f688cde11d9334dddc5d207 ↗
- https://git.kernel.org/stable/c/7b79ca9a1de6a428d486ff52fb3d602321c08f55 ↗
- https://git.kernel.org/stable/c/1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5 ↗
- https://git.kernel.org/stable/c/6312555249082d6d8cc5321ff725df05482d8b83 ↗
- https://git.kernel.org/stable/c/839ecc583fa00fab785fde1c85a326743657fd32 ↗
- https://git.kernel.org/stable/c/638ba5089324796c2ee49af10427459c2de35f71 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-503939.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗