In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: Th…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue` and `ets_qdisc_change`. It leads to UAF on `struct Qdisc` object. Attacker requires the capability to create new user and network namespace in order to trigger the bug. See my additional commentary at the end of the analysis. Analysis…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/062d5d544e564473450d72e6af83077c2b2ff7c3
- https://git.kernel.org/stable/c/06bfb66a7c8b45e3fed01351a4b087410ae5ef39
- https://git.kernel.org/stable/c/45466141da3c98a0c5fa88be0bc14b4b6a4bd75c
- https://git.kernel.org/stable/c/9987cda315c08f63a02423fa2f9a1f6602c861a0
- https://git.kernel.org/stable/c/a75d617a4ef08682f5cfaadc01d5141c87e019c9
- https://git.kernel.org/stable/c/c7f6e7cc14df72b997258216e99d897d2df0dbbd
- https://git.kernel.org/stable/c/ce052b9402e461a9aded599f5b47e76bc727f7de
Timeline
- nvd_ingest NVD