CVE-2023-4921
Use-after-free in Linux kernel's net/sched: sch_qfq component
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.
When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().
We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.
Una vulnerabilidad de use-after-free en el componente net/sched: sch_qfq del kernel de Linux se puede explotar para lograr una escalada de privilegios local. Cuando el complemento qdisc se utiliza como una clase de qfq qdisc, el envío de paquetes de red activa el uso después de la liberación en qfq_dequeue() debido al controlador .peek incorrecto de sch_plug y la falta de verificación de errores en agg_dequeue(). Recomendamos actualizar al commit anterior 8fc134fee27f2263988ae38920bc03da416b03d8.
A use-after-free flaw was found in qfq_dequeue and agg_dequeue in net/sched/sch_qfq.c in the Traffic Control (QoS) subsystem in the Linux kernel. This issue may allow a local user to crash the system or escalate their privileges on the system.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-09-12 CVE Reserved
- 2023-09-12 CVE Published
- 2023-09-15 EPSS Updated
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
- CAPEC-233: Privilege Escalation
References (6)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-4921 | 2024-04-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2245514 | 2024-04-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.8 < 6.6 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.8 < 6.6" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||