net/sched: tcindex: Imperfect Hash Filters Update Vulnerability in Linux Kernel
Summary
GSD-2023-1002306: net/sched: tcindex: update imperfect hash filters respecting rcu. Affects Kernel versions >= 9b0d4446b56904b59ae3809913b0ac760fa941a6, < bd662ba56187b5ef8a62a3511371cd38299a507f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The tcindex module within the kernel is used for traffic control and classification. It employs imperfect hash filters to distribute packets into different traffic classes based on their characteristics. These filters are used to optimize the performance of network traffic management. However, a vulnerability has been discovered in the implementation of imperfect hash filters in the tcindex module.
Vulnerability Detail
The vulnerability in the tcindex module arises from a lack of proper handling of RCU (Read-Copy Update) synchronization. RCU is a mechanism used in the Linux Kernel to allow efficient read access to shared data structures while minimizing the impact on write operations. In this case, the imperfect hash filters in the tcindex module are not updated correctly when RCU synchronization is required. This can lead to inconsistent or incorrect packet classification, potentially resulting in network performance degradation or even security issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the tcindex module or avoid using traffic classification based on imperfect hash filters. This can be achieved by modifying the kernel configuration or using alternative traffic control mechanisms.
Conclusion
The vulnerability in the tcindex module of the Linux Kernel can lead to inconsistent or incorrect packet classification, potentially impacting network performance and security. It is recommended to update the kernel to version v6.1.13 or later to fix this vulnerability. Alternatively, users can disable the tcindex module or avoid using traffic classification based on imperfect hash filters as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in inconsistent or incorrect packet classification, leading to network performance degradation or potential security issues.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Yes, a patch has been released in Linux Kernel version v6.1.13. It is recommended to update to this version or a later one to fix the vulnerability.
Yes, you can disable the tcindex module or avoid using traffic classification based on imperfect hash filters as a temporary workaround. However, updating the kernel is the recommended long-term solution.
At the time of this report, no known exploits have been reported for this vulnerability. However, it is important to apply the necessary updates to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
