In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: bound qdisc_pkt_len to prevent qdisc soft lockup<\/p>\n
qdisc_get_stab() accepts a user-supplied size table, and
\n__qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the
\noverhead, the size-table data (u16), and size_log (up to
\nSTAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len()
\nto ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as
\nDRR and ETS replenish one quantum per loop iteration; with a tiny
\nquantum (1) they spin billions of times under the qdisc lock,
\nproducing a soft lockup \/ RCU stall as illustrated by vega@nebusec.ai.<\/p>\n
Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table
\namplification cannot drive deficit schedulers into an unbounded loop.
\nA legitimate size table (e.g. qfq’s overhead 999999999, which is
\nhandled by dropping) is still accepted.<\/p>\n
Introduce cap QDISC_PKT_LEN_MAX (1 <len
\nis GSO_MAX_SIZE (524280), and an ATM-style size table (53\/48 cell tax)
\namplifies that to ~578 KB, both comfortably below 1 MiB. At the same
\ntime, 1 MiB bounds the deficit refill loop to ~1M iterations per
\npacket with quantum=1, which completes in a few milliseconds well
\nunder the demonstrated softlockup threshold (~10^9 iterations).<\/p>\n
Conditions to recreate the bug:
\n– CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y).
\n– Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that
\n amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]).
\n– Add a class with a tiny quantum of 1 and send one small packet; the
\n deficit loop spins billions of times under the qdisc lock and trips
\n the softlockup detector (panic with kernel.softlockup_panic=1).
\n– Reachable as root or from an unprivileged user in a fresh user+net
\n namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: bound qdisc_pkt_len to prevent qdisc soft lockup<\/p>\n
qdisc_get_stab() accepts a user-supplied size table, and
\n__qdisc_calcu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25467","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25467","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}