CVE-2023-3611: Out-of-bounds write in Linux kernel's net/sched: sch_qfq component
A flaw in the Linux Kernel found. An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg() function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64
Other sources
An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg() function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
— Ubuntu
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds write flaw in the net/sched: schqfq component. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 3e337087c3b5805fe0b8a46ba622a962880b5d64 - Configuration
Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0; apply temporarily with 'sudo sysctl -w kernel.unprivileged_userns_clone=0' and persist across reboots in /etc/sysctl.d/99-disable-unpriv-userns.conf.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3611?
CVE-2023-3611 is a local privilege escalation vulnerability found in the Linux Kernel's sch_qfq component.
How do I fix CVE-2023-3611?
To fix CVE-2023-3611, update to the patched version of the Linux Kernel 6.5 or later, or apply the relevant updates provided by your Linux distribution.
Which Linux Kernel versions are affected by CVE-2023-3611?
CVE-2023-3611 affects Linux Kernel versions prior to 6.5, including versions 3.8 through 6.4.5.
Can CVE-2023-3611 be exploited remotely?
No, CVE-2023-3611 is a local privilege escalation vulnerability that requires local access to exploit.
What components of Linux are impacted by CVE-2023-3611?
CVE-2023-3611 specifically impacts the sch_qfq component within the Linux Kernel.