CVE-2024-53057
Linux kernel net/sched: Qdisc Treeify UAF Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
INFO
Published Date :
Nov. 19, 2024, 6:15 p.m.
Last Modified :
Dec. 11, 2024, 3:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-53057.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-53057 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-53057 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Dec. 11, 2024
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 -
Initial Analysis by [email protected]
Nov. 22, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE NIST CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.25 up to (excluding) 4.19.323 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.285 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.229 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.171 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.116 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.60 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.7 *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:* Changed Reference Type https://git.kernel.org/stable/c/05df1b1dff8f197f1c275b57ccb2ca33021df552 No Types Assigned https://git.kernel.org/stable/c/05df1b1dff8f197f1c275b57ccb2ca33021df552 Patch Changed Reference Type https://git.kernel.org/stable/c/2e95c4384438adeaa772caa560244b1a2efef816 No Types Assigned https://git.kernel.org/stable/c/2e95c4384438adeaa772caa560244b1a2efef816 Patch Changed Reference Type https://git.kernel.org/stable/c/580b3189c1972aff0f993837567d36392e9d981b No Types Assigned https://git.kernel.org/stable/c/580b3189c1972aff0f993837567d36392e9d981b Patch Changed Reference Type https://git.kernel.org/stable/c/597cf9748c3477bf61bc35f0634129f56764ad24 No Types Assigned https://git.kernel.org/stable/c/597cf9748c3477bf61bc35f0634129f56764ad24 Patch Changed Reference Type https://git.kernel.org/stable/c/9995909615c3431a5304c1210face5f268d24dba No Types Assigned https://git.kernel.org/stable/c/9995909615c3431a5304c1210face5f268d24dba Patch Changed Reference Type https://git.kernel.org/stable/c/ce691c814bc7a3c30c220ffb5b7422715458fd9b No Types Assigned https://git.kernel.org/stable/c/ce691c814bc7a3c30c220ffb5b7422715458fd9b Patch Changed Reference Type https://git.kernel.org/stable/c/dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20 No Types Assigned https://git.kernel.org/stable/c/dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20 Patch Changed Reference Type https://git.kernel.org/stable/c/e7f9a6f97eb067599a74f3bcb6761976b0ed303e No Types Assigned https://git.kernel.org/stable/c/e7f9a6f97eb067599a74f3bcb6761976b0ed303e Patch -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 19, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Added Reference kernel.org https://git.kernel.org/stable/c/e7f9a6f97eb067599a74f3bcb6761976b0ed303e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/ce691c814bc7a3c30c220ffb5b7422715458fd9b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/05df1b1dff8f197f1c275b57ccb2ca33021df552 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/580b3189c1972aff0f993837567d36392e9d981b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/597cf9748c3477bf61bc35f0634129f56764ad24 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/9995909615c3431a5304c1210face5f268d24dba [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2e95c4384438adeaa772caa560244b1a2efef816 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-53057 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-53057
weaknesses.