Bug 2226780 (CVE-2023-39190, ZDI-CAN-18568) - CVE-2023-39190 kernel: sch_qfq: net scheduler out-of-bounds write in qfq_update_agg()
Summary: CVE-2023-39190 kernel: sch_qfq: net scheduler out-of-bounds write in qfq_upda...
Keywords:
Status: CLOSED DUPLICATE of bug 2192671
Alias: CVE-2023-39190, ZDI-CAN-18568
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2225771
TreeView+ depends on / blocked
 
Reported: 2023-07-26 13:54 UTC by Mauro Matteo Cascella
Modified: 2025-06-09 06:28 UTC (History)
53 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-07-26 18:55:57 UTC
Embargoed:

Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-07-26 13:54:12 UTC 
An array index out-of-bounds write access was found in the Linux kernel in the qfq_update_agg() function, which belongs to the net scheduler QFQ (Quick Fair Queueing Plus). This flaw requires CAP_NET_ADMIN to be exploited and could lead to local privilege escalation.
Comment 4 Mauro Matteo Cascella 2023-07-26 18:55:57 UTC 

*** This bug has been marked as a duplicate of bug 2192671 ***
Note You need to log in before you can comment on or make changes to this bug.