Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
462dbc9101acd38e92eda93c0726857517a24bbd to < 2a64fb9b47afffeb5dbab5fd3a518e1436dcc90eaffected462dbc9101acd38e92eda93c0726857517a24bbd to < cff6cd703f41d8071995956142729e4bba160363affected462dbc9101acd38e92eda93c0726857517a24bbd to < f06f7635499bc806cbe2bbc8805c7cef8b1edddfaffected462dbc9101acd38e92eda93c0726857517a24bbd to < 0a234660dc70ce45d771cbc76b20d925b73ec160affected462dbc9101acd38e92eda93c0726857517a24bbd to < 362e269bb03f7076ba9990e518aeddb898232e50affected462dbc9101acd38e92eda93c0726857517a24bbd to < e9d8f11652fa08c647bf7bba7dd8163241a332cdaffected462dbc9101acd38e92eda93c0726857517a24bbd to < 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78affected
Linux Linux
Default version status: affected
3.8affected0 to < 3.8unaffected5.10.249 to ≤ 5.10.*unaffected5.15.199 to ≤ 5.15.*unaffected6.1.162 to ≤ 6.1.*unaffected6.6.122 to ≤ 6.6.*unaffected6.12.67 to ≤ 6.12.*unaffected6.18.7 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2a64fb9b47afffeb5dbab5fd3a518e1436dcc90e ↗
- https://git.kernel.org/stable/c/cff6cd703f41d8071995956142729e4bba160363 ↗
- https://git.kernel.org/stable/c/f06f7635499bc806cbe2bbc8805c7cef8b1edddf ↗
- https://git.kernel.org/stable/c/0a234660dc70ce45d771cbc76b20d925b73ec160 ↗
- https://git.kernel.org/stable/c/362e269bb03f7076ba9990e518aeddb898232e50 ↗
- https://git.kernel.org/stable/c/e9d8f11652fa08c647bf7bba7dd8163241a332cd ↗
- https://git.kernel.org/stable/c/3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 ↗