CVE-2023-31436: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX

High severity · published Apr 28, 2023

CVE-2023-31436

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX

7.8

CVSS

0.6%

EPSS

On KEV

Description

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 48% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

3.7 before 4.14.314; 4.15 before 4.19.282; 4.20 before 5.4.242; 5.5.0 before 5.10.179; 5.11 before 5.15.109; 5.16 before 6.1.26; +1 more · source: NVD

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens

before V1.1 · source: CISA

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-31436

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-31436

Third Party Advisory

http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html

Third Party Advisory

http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html

packetstormsecurity.com

http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html

Mailing List

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.13

Patch

https://github.com/torvalds/linux/commit/3037933448f60f9acb705997eae62013ecb81e0d

Mailing List

https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html