net/sched: tcindex: search key must be 16 bits
Summary
GSD-2023-1002373: net/sched: tcindex: search key must be 16 bits. Affects Kernel versions >= eb8e9d8572d1d9df17272783ad8a84843ce559d4, < 4fe9950815e19051b7b8268b4d4c3ac286a741bf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for various Linux distributions. The tcindex module in the kernel is responsible for traffic control indexing. It uses a search key to identify a specific flow. However, in versions prior to v5.10.169, the search key was not restricted to 16 bits, leading to a vulnerability.
Vulnerability Detail
The vulnerability in the tcindex module of the Linux Kernel allows for a search key that exceeds the expected 16-bit limit. This can result in unexpected behavior and potential security issues. The impact and attack plausibility of this vulnerability have not been proven yet. It is fixed in Linux Kernel version v5.10.169 by commit 4fe9950815e19051b7b8268b4d4c3ac286a741bf. The vulnerability was introduced in version v5.10.169 by commit eb8e9d8572d1d9df17272783ad8a84843ce559d4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The tcindex module in the Linux Kernel prior to v5.10.169 is vulnerable to a search key exceeding the expected 16-bit limit. It is recommended to update the kernel to version v5.10.169 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, it has the potential to result in unexpected behavior and security issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will alert you in real-time.
Yes, the vulnerability is fixed in Linux Kernel version v5.10.169. It is recommended to update to this version or later.
The attack plausibility of this vulnerability has not been proven yet. Remote exploitation is dependent on the specific circumstances and configurations of the affected system.
You can refer to the vulnerability details in the GSD Database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2023/1002xxx/GSD-2023-1002373.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
