Skip to content
Heist/ feed
High

net_sched: sch_sfq: don't allow 1 packet limit

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: don't allow 1 packet limit The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well. This fixes the following syzkaller reported crash: UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x125/0x19f lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347 sfq_link net/sched/sch_sfq.c:210 [inline] sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238 sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500 sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296 netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline] dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362 __dev_close_many+0x214/0x350 net/core/dev.c:1468 dev_close_many+0x207/0x510 net/core/dev.c:1506 unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738 unregister_netdevice_queue+0x2be/0x310 ne

Announced Source revision 1
Original source ↗

CVE-2024-57996

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-57996

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "e12f6013d0a69660e8b99bfe381b9546ae667328",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "1e6d9d87626cf89eeffb4d943db12cb5b10bf961",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "1b562b7f9231432da40d12e19786c1bd7df653a7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "35d0137305ae2f97260a9047f445bd4434bd6cc7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "833e9a1c27b82024db7ff5038a51651f48f05e5e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "7fefc294204f10a3405f175f4ac2be16d63f135e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
        "lessThan": "10685681bafce6febb39770f3387621bf5d67d0b",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/sched/sch_sfq.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.12"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.12",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.297",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.239",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.186",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.129",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.76",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.13",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/sched/sch_sfq.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-57996

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26860 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement