Use-after-free vulnerability in net: sched: fix tc_new_tfilter()
Summary
GSD-2022-1000164: net: sched: fix use-after-free in tc_new_tfilter(). Affects Kernel versions >= 470502de5bdb1ed0def643a4458593a40b8f6b66, < b1d17e920dfcd4b56fa2edced5710c191f7e50b5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The 'net' module within the Kernel package handles network-related operations, including traffic control. The 'sched' sub-module within 'net' is responsible for managing the scheduling and prioritization of network traffic. However, a use-after-free vulnerability has been identified in the 'tc_new_tfilter()' function of the 'sched' sub-module.
Vulnerability Detail
The use-after-free vulnerability in 'tc_new_tfilter()' allows an attacker to exploit a freed memory region, potentially leading to arbitrary code execution or a system crash. This vulnerability can be triggered by a malicious user or process that manipulates the network traffic control filters. By carefully crafting network packets or traffic control rules, an attacker can cause the 'tc_new_tfilter()' function to access memory that has already been freed, resulting in undefined behavior. This could potentially be leveraged to execute arbitrary code with kernel privileges or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually by cherry-picking the commit 'b1d17e920dfcd4b56fa2edced5710c191f7e50b5' onto their current Kernel version. This can be done by following these steps:
- Clone the Linux Kernel repository:
git clone https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - Checkout the branch corresponding to the current Kernel version:
git checkout <current_version> - Cherry-pick the fix commit:
git cherry-pick b1d17e920dfcd4b56fa2edced5710c191f7e50b5 - Recompile and install the Kernel.
It is important to note that applying the patch manually may require advanced knowledge of the Linux Kernel and can introduce other risks. Therefore, it is recommended to update to the latest stable version of the Kernel instead.
Conclusion
The use-after-free vulnerability in the 'tc_new_tfilter()' function of the 'sched' sub-module in the Kernel package poses a significant security risk. It is crucial to update the Kernel to version v5.4.177 or later to mitigate this vulnerability. Alternatively, users can apply the patch manually by cherry-picking the fix commit, although this method carries additional risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code with kernel privileges or cause a system crash, leading to a denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this use-after-free vulnerability.
At the time of this report, there are no known public exploits for this vulnerability. However, it is essential to patch your system promptly to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the attacker can send malicious network traffic or control traffic control rules on the targeted system.
The recommended approach is to update the Kernel to the latest version. However, if updating is not feasible, applying the patch manually by cherry-picking the fix commit onto the current Kernel version can serve as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
