High · published July 22, 2023
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.
The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.
We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.8, < 4.14.322 | 4.14.322 |
| linux/linux_kernel | ≥ 4.15, < 4.19.291 | 4.19.291 |
| linux/linux_kernel | ≥ 4.20, < 5.4.253 | 5.4.253 |
| linux/linux_kernel | ≥ 5.5, < 5.10.188 | 5.10.188 |
| linux/linux_kernel | ≥ 5.11, < 5.15.121 | 5.15.121 |
| linux/linux_kernel | ≥ 5.16, < 6.1.40 | 6.1.40 |
| linux/linux_kernel | ≥ 6.2, < 6.4.5 | 6.4.5 |
| linux/linux_kernel | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |