fkie_cve-2025-21647
Vulnerability from fkie_nvd
Published
2025-01-19 11:15
Modified
2025-01-19 11:15
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched: sch_cake: add bounds checks to host bulk flow fairness counts
Even though we fixed a logic error in the commit cited below, syzbot
still managed to trigger an underflow of the per-host bulk flow
counters, leading to an out of bounds memory access.
To avoid any such logic errors causing out of bounds memory accesses,
this commit factors out all accesses to the per-host bulk flow counters
to a series of helpers that perform bounds-checking before any
increments and decrements. This also has the benefit of improving
readability by moving the conditional checks for the flow mode into
these helpers, instead of having them spread out throughout the
code (which was the cause of the original logic error).
As part of this change, the flow quantum calculation is consolidated
into a helper function, which means that the dithering applied to the
ost load scaling is now applied both in the DRR rotation and when a
sparse flow's quantum is first initiated. The only user-visible effect
of this is that the maximum packet size that can be sent while a flow
stays sparse will now vary with +/- one byte in some cases. This should
not make a noticeable difference in practice, and thus it's not worth
complicating the code to preserve the old behaviour.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: sch_cake: add bounds checks to host bulk flow fairness counts\n\nEven though we fixed a logic error in the commit cited below, syzbot\nstill managed to trigger an underflow of the per-host bulk flow\ncounters, leading to an out of bounds memory access.\n\nTo avoid any such logic errors causing out of bounds memory accesses,\nthis commit factors out all accesses to the per-host bulk flow counters\nto a series of helpers that perform bounds-checking before any\nincrements and decrements. This also has the benefit of improving\nreadability by moving the conditional checks for the flow mode into\nthese helpers, instead of having them spread out throughout the\ncode (which was the cause of the original logic error).\n\nAs part of this change, the flow quantum calculation is consolidated\ninto a helper function, which means that the dithering applied to the\nost load scaling is now applied both in the DRR rotation and when a\nsparse flow\u0027s quantum is first initiated. The only user-visible effect\nof this is that the maximum packet size that can be sent while a flow\nstays sparse will now vary with +/- one byte in some cases. This should\nnot make a noticeable difference in practice, and thus it\u0027s not worth\ncomplicating the code to preserve the old behaviour."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched: sch_cake: agregar comprobaciones de los l\u00edmites a los recuentos de equidad de flujo masivo del host Aunque arreglamos un error l\u00f3gico en el commit citada a continuaci\u00f3n, syzbot a\u00fan logr\u00f3 activar un desbordamiento de los contadores de flujo masivo por host, lo que provoc\u00f3 un acceso a la memoria fuera de los l\u00edmites. Para evitar que dichos errores l\u00f3gicos provoquen accesos a la memoria fuera de los l\u00edmites, esta confirmaci\u00f3n elimina todos los accesos a los contadores de flujo masivo por host a una serie de ayudantes que realizan la comprobaci\u00f3n de los l\u00edmites antes de cualquier incremento o decremento. Esto tambi\u00e9n tiene el beneficio de mejorar la legibilidad al mover las comprobaciones condicionales para el modo de flujo a estos ayudantes, en lugar de tenerlas distribuidas por todo el c\u00f3digo (que era la causa del error l\u00f3gico original). Como parte de este cambio, el c\u00e1lculo cu\u00e1ntico de flujo se consolida en una funci\u00f3n auxiliar, lo que significa que el tramado aplicado al escalamiento de carga ost ahora se aplica tanto en la rotaci\u00f3n DRR como cuando se inicia por primera vez el cu\u00e1ntico de un flujo disperso. El \u00fanico efecto visible para el usuario es que el tama\u00f1o m\u00e1ximo de paquete que se puede enviar mientras un flujo permanece disperso variar\u00e1 ahora en +/- un byte en algunos casos. Esto no deber\u00eda suponer una diferencia notable en la pr\u00e1ctica y, por lo tanto, no vale la pena complicar el c\u00f3digo para conservar el comportamiento anterior."
}
],
"id": "CVE-2025-21647",
"lastModified": "2025-01-19T11:15:10.307",
"metrics": {},
"published": "2025-01-19T11:15:10.307",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/27202e2e8721c3b23831563c36ed5ac7818641ba"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/737d4d91d35b5f7fa5bb442651472277318b0bfd"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/91bb18950b88f955838ec0c1d97f74d135756dc7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a777e06dfc72bed73c05dcb437d7c27ad5f90f3f"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.