Out-of-bounds read in Linux kernel sched

1) Out-of-bounds read

EUVDB-ID: #VU108795

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-36791

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tcindex_set_parms() function in net/sched/cls_tcindex.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.4 - 4.4.217

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:4.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.0-57:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.6:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.4.7:*:*:*:*:*:*:*

External links

https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html
https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3
https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2
https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266
https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9
https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386
https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf
https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454
https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.218

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.