Bug 2237757 (CVE-2023-4623)

Summary:	CVE-2023-4623 kernel: net/sched: sch_hfsc UAF
Product:	[Other] Security Response	Reporter:	juneau
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, ahanwate, allarkin, bhu, chwhite, dbohanno, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, nmurray, ptalbert, rkeshri, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, shuali, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---	Flags:	ptalbert: needinfo-
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw was found in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component that can be exploited to achieve local privilege escalation. If a class with a link-sharing curve, for example, with the HFSC_FSC flag set, has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free issue.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2249630
Bug Blocks:	2237759

Description juneau 2023-09-06 18:06:53 UTC

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

https://kernel.dance/b3d26c5702c7d6c45456326e56d2ccf3f103e60f
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b3d26c5702c7d6c45456326e56d2ccf3f103e60f

Comment 6 Alex 2023-11-14 13:16:10 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2249630]

Comment 14 Justin M. Forbes 2023-11-14 21:56:58 UTC

This was fixed for Fedora with the 6.5.3 stable kernel updates.

Comment 27 errata-xmlrpc 2024-01-23 09:12:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:0340 https://access.redhat.com/errata/RHSA-2024:0340

Comment 28 errata-xmlrpc 2024-01-23 17:28:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0378 https://access.redhat.com/errata/RHSA-2024:0378

Comment 29 errata-xmlrpc 2024-01-23 17:50:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0381 https://access.redhat.com/errata/RHSA-2024:0381

Comment 30 errata-xmlrpc 2024-01-24 09:07:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:0386 https://access.redhat.com/errata/RHSA-2024:0386

Comment 31 errata-xmlrpc 2024-01-24 15:24:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:0431 https://access.redhat.com/errata/RHSA-2024:0431

Comment 32 errata-xmlrpc 2024-01-24 15:25:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:0432 https://access.redhat.com/errata/RHSA-2024:0432

Comment 33 errata-xmlrpc 2024-01-24 16:29:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:0461 https://access.redhat.com/errata/RHSA-2024:0461

Comment 34 errata-xmlrpc 2024-01-24 16:36:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0439 https://access.redhat.com/errata/RHSA-2024:0439

Comment 35 errata-xmlrpc 2024-01-24 16:38:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0448 https://access.redhat.com/errata/RHSA-2024:0448

Comment 36 errata-xmlrpc 2024-01-24 16:45:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0412 https://access.redhat.com/errata/RHSA-2024:0412

Comment 37 errata-xmlrpc 2024-01-30 00:33:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0554 https://access.redhat.com/errata/RHSA-2024:0554

Comment 38 errata-xmlrpc 2024-01-30 12:27:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:0563 https://access.redhat.com/errata/RHSA-2024:0563

Comment 39 errata-xmlrpc 2024-01-30 12:27:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:0562 https://access.redhat.com/errata/RHSA-2024:0562

Comment 40 errata-xmlrpc 2024-01-30 13:10:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:0593 https://access.redhat.com/errata/RHSA-2024:0593

Comment 41 errata-xmlrpc 2024-01-30 13:22:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0575 https://access.redhat.com/errata/RHSA-2024:0575

Comment 43 errata-xmlrpc 2024-02-20 04:53:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0876 https://access.redhat.com/errata/RHSA-2024:0876

Comment 44 errata-xmlrpc 2024-02-20 12:28:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0881 https://access.redhat.com/errata/RHSA-2024:0881

Comment 45 errata-xmlrpc 2024-02-20 12:33:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0897 https://access.redhat.com/errata/RHSA-2024:0897

Comment 46 errata-xmlrpc 2024-03-12 11:44:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2024:1268 https://access.redhat.com/errata/RHSA-2024:1268

Comment 47 errata-xmlrpc 2024-03-12 11:45:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2024:1269 https://access.redhat.com/errata/RHSA-2024:1269

Comment 48 errata-xmlrpc 2024-03-12 15:00:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2024:1278 https://access.redhat.com/errata/RHSA-2024:1278

Comment 49 errata-xmlrpc 2024-04-10 08:02:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support

Via RHSA-2024:1747 https://access.redhat.com/errata/RHSA-2024:1747

Comment 50 errata-xmlrpc 2024-04-10 08:05:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:1746 https://access.redhat.com/errata/RHSA-2024:1746

Comment 51 errata-xmlrpc 2024-04-23 00:42:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:1960 https://access.redhat.com/errata/RHSA-2024:1960

Comment 52 errata-xmlrpc 2024-04-23 15:43:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:2003 https://access.redhat.com/errata/RHSA-2024:2003

Comment 53 errata-xmlrpc 2024-04-23 16:38:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:2004 https://access.redhat.com/errata/RHSA-2024:2004