A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.
Una vulnerabilidad de Use After Free en el componente net/sched: sch_hfsc (HFSC qdisc traffic control) del kernel de Linux puede ser explotada para conseguir una escalada local de privilegios. Si una clase con una curva de compartición de enlaces (es decir, con la flag HFSC_FSC establecida) tiene un padre sin una curva de compartición de enlaces, entonces init_vf() llamará a vttree_insert() en el padre, pero vttree_remove() se omitirá en update_vf(). Esto deja un puntero colgando que puede causar un Use-After-Free. Recomendamos actualizar desde el commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-416
|
| [email protected] | Primary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384917fc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384914f80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ab76780> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694e6ac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384914dc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384916440> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36be78b40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384915dc0> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd384915a80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |