[SRU Focal/Impish 0/1] CVE-2022-1055

Thadeu Lima de Souza Cascardo cascardo at canonical.com
Thu Mar 24 11:22:21 UTC 2022

An unprivileged user can use TC to write to out-of-bounds memory, possibly
leading to a privilege escalation.

There was no flags at tc_new_tfilter, which was introduced by a later rewrite.

[Test case]
The syzkaller report had no reproducer, and one could not be found or written.

[Potential regression]
qdisc configuration and use can lead to unexpected network behavior.

Eric Dumazet (1):
  net: sched: fix use-after-free in tc_new_tfilter()

 net/sched/cls_api.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)


More information about the kernel-team mailing list