CVE-2025-21703

Feb. 21, 2025, 2:15 p.m.

7.8
High

Description

In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.

Product(s) Impacted

Product Versions
Linux Kernel

Weaknesses

CWE-416
Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://git.kernel.org/stable/c/1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5
https://git.kernel.org/stable/c/6312555249082d6d8cc5321ff725df05482d8b83
https://git.kernel.org/stable/c/638ba5089324796c2ee49af10427459c2de35f71
https://git.kernel.org/stable/c/7b79ca9a1de6a428d486ff52fb3d602321c08f55
https://git.kernel.org/stable/c/839ecc583fa00fab785fde1c85a326743657fd32

Tags

416baaa9-dc9f-4396-8d5f-8c081fb06d67
CWE-416
2025-02-18
CVE-2025-21703

CVSS Score

7.8 / 10

CVSS Data

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Date

  • Published: Feb. 18, 2025, 3:15 p.m.
  • Last Modified: Feb. 21, 2025, 2:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.