CVE-2021-47595

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_ets: don't remove idle classes from the round-robin list

Shuang reported that the following script:

1) tc qdisc add dev ddd0 handle 10: parent 1: ets bands 8 strict 4 priomap 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7

2) mausezahn ddd0 -A 10.10.10.1 -B 10.10.10.2 -c 0 -a own -b 00:c1:a0:c1:a0:00 -t udp &

3) tc qdisc change dev ddd0 handle 10: ets bands 4 strict 2 quanta 2500 2500 priomap 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3

crashes systematically when line 2) is commented:

list_del corruption, ffff8e028404bd30->next is LIST_POISON1 (dead000000000100)

------------[ cut here ]------------

kernel BUG at lib/list_debug.c:47!

invalid opcode: 0000 [#1] PREEMPT SMP NOPTI

CPU: 0 PID: 954 Comm: tc Not tainted 5.16.0-rc4+ #478

Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014

RIP: 0010:__list_del_entry_valid.cold.1+0x12/0x47

Code: fe ff 0f 0b 48 89 c1 4c 89 c6 48 c7 c7 08 42 1b 87

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References