In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: sch_qfq: Corrección de la condición de ejecución en qfq_aggregate. Una condición de ejecución puede ocurrir cuando se modifica 'agg' en qfq_change_agg (llamado durante qfq_enqueue) mientras otros subprocesos acceden a él simultáneamente. Por ejemplo, qfq_dump_class puede desencadenar una desreferencia a NULL y qfq_delete_class puede causar un use-after-free. Este parche soluciona el problema mediante: 1. El traslado de qfq_destroy_class a la sección crítica. 2. La adición de la protección sch_tree_lock a qfq_dump_class y qfq_dump_class_stats.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-362
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bfc132100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bfc4c2e80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bfc130140> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bfc36b880> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bfc132980> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bfc132e80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bddfb5a40> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bfc132580> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bfc4c1980> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bfc130180> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bddfb5c00> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bfc36b0c0> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702c08badfc0> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x702bde255880> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |