net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
CVE-2024-53057
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-53057
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "e7f9a6f97eb067599a74f3bcb6761976b0ed303e",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "ce691c814bc7a3c30c220ffb5b7422715458fd9b",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "05df1b1dff8f197f1c275b57ccb2ca33021df552",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "580b3189c1972aff0f993837567d36392e9d981b",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "597cf9748c3477bf61bc35f0634129f56764ad24",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "9995909615c3431a5304c1210face5f268d24dba",
"versionType": "git"
},
{
"status": "affected",
"version": "066a3b5b2346febf9a655b444567b7138e3bb939",
"lessThan": "2e95c4384438adeaa772caa560244b1a2efef816",
"versionType": "git"
}
],
"programFiles": [
"net/sched/sch_api.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.25",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.323",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.229",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.171",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.116",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.60",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.11.7",
"versionType": "semver",
"lessThanOrEqual": "6.11.*"
},
{
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sched/sch_api.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-53057
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26809 · Revision 1
- Added to Heist Feed
- Publisher date