In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: hhf: cap hh_flows_limit at change time<\/p>\n
hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge
\nhh_flows_limit lets each new heavy-hitter flow pass the
\nhh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size
\nkzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory
\ngrowth.<\/p>\n
Bound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the
\nhhf_init() default) and report the rejected value via extack. The
\ndeprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on
\nTCA_OPTIONS. Configs relying on hh_limit above the default were relying
\non unbounded, unsafe behaviour and are not supported going forward.<\/p>\n
hhf_init() also ran hhf_change() before setting the default
\nhh_flows_limit, so a user-supplied hh_limit at add time was clobbered
\nback to 2048. Set the default before hhf_change() so the configured
\nvalue sticks.<\/p>\n
This is a follow-up to commit eb56a495f59b (“net\/sched: hhf: clamp
\nquantum in change and init paths”), which bounded the quantum of the
\nsame qdisc; the hh_flows_limit bound is the remaining unbounded knob of
\nthat series’ scope.<\/p>\n
Conditions to recreate the bug: CAP_NET_ADMIN in a user namespace;
\ntc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the
\nvalue is echoed by tc qdisc show, unbounding heavy-hitter flow
\nallocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048
\ninstead of 500.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: hhf: cap hh_flows_limit at change time<\/p>\n
hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge
\nhh_flows_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33303","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}