CVE-2024-53044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()

This command:

$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact

Error: block dev insert failed: -EBUSY.

fails because user space requests the same block index to be set for

both ingress and egress.

[ side note, I don't think it even failed prior to commit 913b47d3424e

("net/sched: Introduce tc block netdev tracking infra"), because this

is a command from an old set of notes of mine which used to work, but

alas, I did not scientifically bisect this ]

The problem is not that it fails, but rather, that the second time

around, it fails differently (and irrecoverably):

$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact

Error: dsa_core: Flow block cb is busy.

[ another note: the extack is added by me for illustration purposes.

the context of the problem is that clsact_init() obtains the same

&q->ingress_bloc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References