Description
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Linux / Kernel3.8 – 6.5
References
- MISChttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64
- MISChttps://kernel.dance/3e337087c3b5805fe0b8a46ba622a962880b5d64
- VENDOR_ADVISORYhttps://www.debian.org/security/2023/dsa-5480
- MISChttps://security.netapp.com/advisory/ntap-20230908-0002/
- VENDOR_ADVISORYhttps://www.debian.org/security/2023/dsa-5492
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2024/01/msg00004.html