CVE-2025-38001.zip
6.6 KB
CVE-2025-38001
Author: boeseejykbtanke348

In the Linux kernel, the following vulnerability has been resolved:

netsched: hfsc: Address reentrant enqueue adding class to eltree twice

Savino says:
"We are writing to report that this recent patch
(141d34391abbb315d68556b7c67ad97885407547) [1]
can be bypassed, and a UAF can still occur when HFSC is utilized with
NETEM.

The patch only checks the cl->cl
nactive field to determine whether
it is the first insertion or not 2, but this field is only
incremented by initvf [3].

By using HFSC
RSC (which uses inited) [4], it is possible to bypass the
check and insert the class twice in the eltree.
Under normal conditions, this would lead to an infinite loop in
hfsc
dequeue for the reasons we already explained in this report 5.

However, if TBF is added as root qdisc and it is configured with a
ver...