CVE-2023-3611: Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

First published: Fri Jul 21 2023(Updated: )

A flaw in the Linux Kernel found. An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. Reference: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64</a>

Credit: cve-coordination@google.com cve-coordination@google.com cve-coordination@google.com

Affected Software	Affected Version	How to fix
Linux Linux kernel	>=3.8<6.5
Linux Linux kernel	=6.5-rc1
F5 Traffix SDC	=5.2.0=5.1.0
IBM QRadar SIEM	<=7.5 - 7.5.0 UP8 IF01
Linux Linux kernel	>=3.8<4.14.322
Linux Linux kernel	>=4.15<4.19.291
Linux Linux kernel	>=4.20<5.4.253
Linux Linux kernel	>=5.5<5.10.188
Linux Linux kernel	>=5.11<5.15.121
Linux Linux kernel	>=5.16<6.1.40
Linux Linux kernel	>=6.2<6.4.5
Debian Debian Linux	=10.0
Debian Debian Linux	=11.0
Debian Debian Linux	=12.0
redhat/Kernel	<6.5	6.5
debian/linux		5.10.223-1 5.10.226-1 6.1.115-1 6.1.112-1 6.11.5-1 6.11.7-1

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64

Remedy

https://kernel.dance/3e337087c3b5805fe0b8a46ba622a962880b5d64

Remedy

If not needed, disable the ability for unprivileged users to create namespaces. To do this temporarily, do: sudo sysctl -w kernel.unprivileged_userns_clone=0 To disable across reboots, do: echo kernel.unprivileged_userns_clone=0 | \ sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf