Описание
In the Linux kernel, the following vulnerability has been resolved:
net_sched: drr: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem
child qdisc will make the parent qdisc's enqueue callback reentrant.
In the case of drr, there won't be a UAF, but the code will add the same
classifier to the list twice, which will cause memory corruption.
In addition to checking for qlen being zero, this patch checks whether the
class was already added to the active_list (cl_is_active) before adding
to the list to cover for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to be registered twice. A local user could exploit this issue to cause memory corruption, leading to a system crash and Denial of Service (DoS).
Отчет
A moderate-severity vulnerability affects the Linux kernel's Deficit Round Robin (DRR) network scheduler (net_sched) in the kernel and kernel-rt packages shipped in Red Hat Enterprise Linux 8, and in the Hosted OpenShift offerings (OpenShift Dedicated and Azure Red Hat OpenShift) built on RHEL 8 kernels. When a DRR class is configured with a network emulator (netem) child qdisc, the netem child can make the parent qdisc's enqueue callback reentrant, causing the same class to be added to the active list twice. This double list insertion results in kernel memory corruption that can crash the system, causing a denial of service. Exploitation requires local access with the privileges needed to configure network traffic control; the flaw does not involve a use-after-free and has no confidentiality impact. Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 6 and 7 are out of support scope. The fix for the affected Red Hat Enterprise Linux 8 streams is deferred. The residual risk is limited because an attacker already needs local network-configuration privileges, the attack complexity is high, and the impact is memory corruption leading to a system crash (availability) rather than disclosure of information. Red Hat rates this flaw as MODERATE (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), which differs from the NIST rating of 7.0 and the CVE.org rating of 7.8; Red Hat's scoring reflects the local, privilege-requiring attack path with high attack complexity and no confidentiality impact.
Меры по смягчению последствий
This flaw is triggered only when a netem qdisc is attached as a child of a DRR class. As a workaround, avoid this configuration: remove or replace netem child qdiscs that are attached under a DRR parent qdisc, since without the netem child the DRR enqueue callback is not reentrant and a class cannot be added to the active list twice. There is no other mitigation available for affected systems at this time; apply kernel updates when a fix is released for the deferred streams.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
net_sched: drr: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
EPSS
6.3 Medium
CVSS3