CVE-2024-50039

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: accept TCA_STAB only for root qdisc

Most qdiscs maintain their backlog using qdisc_pkt_len(skb)

on the assumption it is invariant between the enqueue()

and dequeue() handlers.

Unfortunately syzbot can crash a host rather easily using

a TBF + SFQ combination, with an STAB on SFQ [1]

We can't support TCA_STAB on arbitrary level, this would

require to maintain per-qdisc storage.

[1]

[ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 88.798611] #PF: supervisor read access in kernel mode

[ 88.799014] #PF: error_code(0x0000) - not-present page

[ 88.799506] PGD 0 P4D 0

[ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI

[ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117

[ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

[ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References