Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2]. 2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem. 3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard. 4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems. [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/
Product status
0afb51e72855971dba83b3c6b70c547c2d1161fd before ad340a4b4adb855b18b3666f26ad65c8968e2deb
0afb51e72855971dba83b3c6b70c547c2d1161fd before f088b6ebe8797a3f948d2cae47f34bfb45cc6522
0afb51e72855971dba83b3c6b70c547c2d1161fd before cab2809944989889f88a1a8b5cff1c78460c72cb
0afb51e72855971dba83b3c6b70c547c2d1161fd before 325f5ec67cc0a77f2d0d453445b9857f1cd06c76
0afb51e72855971dba83b3c6b70c547c2d1161fd before 103c4e27ec9f5fe53022e46e976abf52c7221baf
0afb51e72855971dba83b3c6b70c547c2d1161fd before 795cb393e38977aa991e70a9363da0ee734b2114
0afb51e72855971dba83b3c6b70c547c2d1161fd before 250f8796006c0f2bc638ce545f601d49ae8d528b
0afb51e72855971dba83b3c6b70c547c2d1161fd before 09317dfb681ac5a96fc69bea0c54441cf91b8270
0afb51e72855971dba83b3c6b70c547c2d1161fd before ec8e0e3d7adef940cdf9475e2352c0680189d14e
2.6.12
Any version before 2.6.12
5.4.297
5.10.241
5.15.190
6.1.148
6.6.102
6.12.42
6.15.10
6.16.1
6.17
References
git.kernel.org/...c/ad340a4b4adb855b18b3666f26ad65c8968e2deb
git.kernel.org/...c/f088b6ebe8797a3f948d2cae47f34bfb45cc6522
git.kernel.org/...c/cab2809944989889f88a1a8b5cff1c78460c72cb
git.kernel.org/...c/325f5ec67cc0a77f2d0d453445b9857f1cd06c76
git.kernel.org/...c/103c4e27ec9f5fe53022e46e976abf52c7221baf
git.kernel.org/...c/795cb393e38977aa991e70a9363da0ee734b2114
git.kernel.org/...c/250f8796006c0f2bc638ce545f601d49ae8d528b
git.kernel.org/...c/09317dfb681ac5a96fc69bea0c54441cf91b8270
git.kernel.org/...c/ec8e0e3d7adef940cdf9475e2352c0680189d14e
