Skip to content
Heist/ feed
High

net/sched: accept TCA_STAB only for root qdisc

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage. [1] [ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 88.798611] #PF: supervisor read access in kernel mode [ 88.799014] #PF: error_code(0x0000) - not-present page [ 88.799506] PGD 0 P4D 0 [ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00 All code ======== 0: 0f b7 50 12 movzwl 0x12(%rax),%edx 4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax b: 00 c: 48 89 d6 mov %rdx,%rsi f: 48 29 d0 sub %rdx,%rax 12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx 19: 48 c1 e0 03 shl $0x3,%rax 1d: 48 01 c2 add %rax,%rdx 20: 66 83 7a

Announced Source revision 1
Original source ↗

CVE-2024-50039

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-50039

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "2acbb9539bc2284e30d2aeb789c3d96287014264",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "adbc3eef43fc94c7c8436da832691ae02333a972",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "8fb6503592d39065316f45d267c5527b4e7cd995",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "76feedc74b90270390fbfdf74a2e944e96872363",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "1edf039ee01788ffc25625fe58a903ae2efa213e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "3dc6ee96473cc2962c6db4297d4631f261be150f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "175f9c1bba9b825d22b142d183c9e175488b260c",
        "lessThan": "3cb7cf1540ddff5473d6baeb530228d19bc97b8a",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "include/net/sch_generic.h",
      "net/sched/sch_api.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.27"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.27",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.285",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.227",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.168",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.113",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.57",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.11.4",
        "versionType": "semver",
        "lessThanOrEqual": "6.11.*"
      },
      {
        "status": "unaffected",
        "version": "6.12",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "include/net/sch_generic.h",
      "net/sched/sch_api.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-50039

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26776 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement