CVE-2023-31436 : qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.

Published 2023-04-28 02:15:09

Updated 2023-11-29 15:15:08

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2023-31436

Linux » Linux Kernel
Versions from including (>=) 5.16 and before (<) 6.1.26
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.5.0 and before (<) 5.10.179
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.20 and before (<) 5.4.242
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.15 and before (<) 4.19.282
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.11 and before (<) 5.15.109
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 6.2 and before (<) 6.2.13
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.7 and before (<) 4.14.314
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-31436

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-31436

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-31436

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-31436

http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html

Kernel Live Patch Security Notice LSN-0095-1 ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html

Kernel Live Patch Security Notice LSN-0096-1 ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html

Kernel Live Patch Security Notice LSN-0099-1 ≈ Packet Storm

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20230609-0001/

CVE-2023-31436 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://github.com/torvalds/linux/commit/3037933448f60f9acb705997eae62013ecb81e0d

net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg · torvalds/linux@3037933 · GitHub
Patch
https://www.debian.org/security/2023/dsa-5402

Debian -- Security Information -- DSA-5402-1 linux
VDB Entry

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html

[SECURITY] [DLA 3446-1] linux-5.10 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.13

Mailing List;Patch
https://www.spinics.net/lists/stable-commits/msg294885.html

Patch "net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg" has been added to the 6.2-stable tree — Linux Stable Commits
Mailing List;Patch

Jump to

Vulnerability Details : CVE-2023-31436

Products affected by CVE-2023-31436

Exploit prediction scoring system (EPSS) score for CVE-2023-31436

CVSS scores for CVE-2023-31436

CWE ids for CVE-2023-31436

References for CVE-2023-31436