NetSight
IP …
high7.8

CVE-2023-3611

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

Impact

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.8 before 4.14.322
from 4.15 before 4.19.291
from 4.20 before 5.4.253
from 5.5 before 5.10.188
from 5.11 before 5.15.121
from 5.16 before 6.1.40
DebianDebian Linux
Versions 10.0, 11.0, 12.0

Weakness classification

CWE-787

References