PT-2024-11222 · Linux+1 · Linux Kernel+1
Davide Caratti
·
Published
2021-05-23
·
Updated
2024-08-19
·
CVE-2021-47175
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.12.0+
Description
The issue is related to an out-of-bounds access in the traffic path of the Linux kernel's fq pie module. This occurs when the
fq pie qdisc enqueue function attempts to access memory beyond the allocated bounds. The vulnerability can be triggered by executing a specific script that involves adding a qdisc and filter to a network device, and then sending a ping request. The vulnerability is caused by the selection of an invalid flow, specifically q->flows + q->flows cnt, which is an address beyond the allocated memory.Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for the out-of-bounds access in the fq pie module. Specifically, versions prior to 5.12.0 should be updated to 5.12.0 or later. As a temporary workaround, consider disabling the
fq pie qdisc enqueue function until a patch is available. However, this may have performance implications and should be carefully evaluated before implementation.Note: The provided information does not specify the exact version that includes the fix, so it is recommended to update to the latest available version of the Linux kernel.
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Suse