PT-2023-4754 · Linux+2 · Linux Kernel+2

Published 2023-04-14 · Updated 2023-09-05 · CVE-2023-2248

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A heap out-of-bounds read/write issue in the Linux Kernel traffic control (QoS) subsystem can be exploited to achieve local privilege escalation. The qfq change class function does not properly limit the lmax variable, which can lead to out-of-bounds read/write. If the TCA QFQ LMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1, and as a result, it is possible to have an lmax value that exceeds QFQ MIN LMAX.

Recommendations Upgrade past commit 3037933448f60f9acb705997eae62013ecb81e0d to resolve the issue. As a temporary workaround, consider restricting the MTU value of the loopback device to prevent excessive lmax values. Avoid using the TCA QFQ LMAX value through nlattr until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2023-1851

BDU:2023-05193

CVE-2023-2248

MGASA-2023-0166

MGASA-2023-0173

Affected Products

Alt Linux

Linux Kernel

Red Os

References · 37

• 🔥 https://kernel.dance/3037933448f60f9acb705997eae62013ecb81e0d · Exploit
• 🔥 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3037933448f60f9acb705997eae62013ecb81e0d · Exploit
• https://ubuntu.com/security/CVE-2023-2248 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05193 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-31436 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-2248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2248 · Security Note
• https://advisories.mageia.org/MGASA-2023-0166.html · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0173 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0173.html · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0166 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-12375.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2248 · Vendor Advisory
• https://github.com/torvalds/linux/commit/3037933448f60f9acb705997eae62013ecb81e0d · Note
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.109 · Note