CVE-2023-31436: High severity Linux Linux kernel vulnerability
A flaw in the Linux Kernel found. A heap out-of-bounds read vulnerability in the Linux Kernel traffic control (QoS) subsystem can be exploited to achieve local privilege escalation. The qfqchangeclass function does not properly limit the lmax variable which can lead to out-of-bounds read/write. If the TCAQFQLMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1 and as a result, it is possible to have an lmax value that exceeds QFQMINLMAX.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3037933448f60f9acb705997eae62013ecb81e0d
Other sources
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds write in qfqchangeclass in net/sched/schqfq.c. An attacker could exploit this vulnerability to gain elevated privileges on the system.
— IBM
qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX.
Affected Software
Remediation
Patch Available
Mitigation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31436?
CVE-2023-31436 is classified as a high-severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2023-31436?
To mitigate CVE-2023-31436, update the Linux Kernel to a version that has addressed this vulnerability, such as 5.10.223-1 or a later release.
Which systems are affected by CVE-2023-31436?
CVE-2023-31436 affects various versions of the Linux Kernel ranging from 3.7 up to 6.2.13, as well as IBM Security Verify Governance components up to version ISVG 10.0.2.
What kind of exploit is possible with CVE-2023-31436?
CVE-2023-31436 can be exploited to perform a heap out-of-bounds read, potentially leading to unauthorized access to kernel memory.
Is there a workaround for CVE-2023-31436 if I cannot upgrade?
There is no effective workaround for CVE-2023-31436, so upgrading to a patched version is strongly recommended.