CVE-2023-3611: Out-of-bounds write in Linux kernel's net/sched: sch_qfq component
A flaw in the Linux Kernel found. An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg() function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64
Other sources
An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation.
The qfqchangeagg() function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.
We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds write flaw in the net/sched: schqfq component. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.5 - Upgrade
Upgrade
linux kernel net/sched sch_qfqto a version that resolves this vulnerability.Patch 3e337087c3b5805fe0b8a46ba622a962880b5d64 - Configuration
Disable unprivileged user namespaces (to reduce exploitability): set kernel.unprivileged_userns_clone=0 temporarily with `sysctl -w kernel.unprivileged_userns_clone=0`, and persist across reboots by writing `/etc/sysctl.d/99-disable-unpriv-userns.conf` with `kernel.unprivileged_userns_clone=0`.
Linux kernel sysctl kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3611?
CVE-2023-3611 is a local privilege escalation vulnerability found in the Linux Kernel's sch_qfq component.
How do I fix CVE-2023-3611?
To fix CVE-2023-3611, update to the patched version of the Linux Kernel 6.5 or later, or apply the relevant updates provided by your Linux distribution.
Which Linux Kernel versions are affected by CVE-2023-3611?
CVE-2023-3611 affects Linux Kernel versions prior to 6.5, including versions 3.8 through 6.4.5.
Can CVE-2023-3611 be exploited remotely?
No, CVE-2023-3611 is a local privilege escalation vulnerability that requires local access to exploit.
What components of Linux are impacted by CVE-2023-3611?
CVE-2023-3611 specifically impacts the sch_qfq component within the Linux Kernel.