Out-of-Bounds Access in net/sched: fq_pie
Summary
GSD-2021-1000611: net/sched: fq_pie: fix OOB access in the traffic path. Affects Kernel versions >= ec97ecf1ebe485a17cd8395a5f35e6b80b57665a, < e6294c06e7c62ffdd5bf3df696d3a4fcbb753d3c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the essential services for the operating system, such as process management, memory management, device management, and file system access. The net/sched subsystem in the Linux Kernel is responsible for network traffic control and scheduling. One component of this subsystem is fq_pie, which implements the Fair Queuing with Packet-based ECN marking algorithm. This algorithm aims to improve network performance and fairness. However, a vulnerability has been discovered in fq_pie that allows for out-of-bounds access in the traffic path.
Vulnerability Detail
The vulnerability in fq_pie arises from an out-of-bounds access issue in the traffic path. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information or execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Linux Kernel version v5.6 and was fixed in version v5.10.42 by commit e6294c06e7c62ffdd5bf3df696d3a4fcbb753d3c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The fq_pie component in the net/sched subsystem of the Linux Kernel is vulnerable to an out-of-bounds access issue. This vulnerability could potentially allow attackers to gain unauthorized access or execute arbitrary code. It is recommended to update the Linux Kernel to version v5.10.42 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, an attacker could gain unauthorized access to sensitive information or execute arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a patch for this vulnerability is available in Linux Kernel version v5.10.42. It is recommended to update to this version or later to fix the vulnerability.
There are no specific mitigations mentioned for this vulnerability. It is recommended to update the kernel as soon as possible to ensure the security of your system.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000611.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
