CVSS 7.8 · High EPSS 0,27%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 3.3 hingga sebelum 4.19.322 |
| linux | linux kernel | Versi 4.20 hingga sebelum 5.4.284 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.226 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.167 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.1.110 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.51 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.10.10 |
| linux | linux kernel | Versi 6.11 rc1 |
| linux | linux kernel | Versi 6.11 rc2 |
| linux | linux kernel | Versi 6.11 rc3 |
| linux | linux kernel | Versi 6.11 rc4 |
| linux | linux kernel | Versi 6.11 rc5 |
| linux | linux kernel | Versi 6.11 rc6 |