CVE-2023-31436
Linux Kernel Net Scheduler Out-Of-Bounds Access Local Privilege Escalation Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.
An out-of-bounds memory access flaw was found in the Linux kernel’s traffic control (QoS) subsystem in how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the system.
This vulnerability allows local attackers to escalate privileges on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of the MTU value provided to the QFQ Scheduler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-04-28 CVE Reserved
- 2023-04-28 CVE Published
- 2024-10-21 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (11)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2023/dsa-5402 | 2023-11-29 | |
| https://access.redhat.com/security/cve/CVE-2023-31436 | 2024-04-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2192671 | 2024-04-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 4.14.314 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 4.14.314" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.15 < 4.19.282 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.15 < 4.19.282" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.20 < 5.4.242 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.20 < 5.4.242" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.5.0 < 5.10.179 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.5.0 < 5.10.179" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.11 < 5.15.109 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.11 < 5.15.109" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.16 < 6.1.26 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.16 < 6.1.26" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.2 < 6.2.13 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.2 < 6.2.13" | - |
Affected
| ||||||