Home > Vulnerability Database > CVE-2023-3611

Mend.io Vulnerability Database

CVE-2023-3611

Good to know:

Date: July 21, 2023

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Language: C

Severity Score

7.8

Related Resources (10)

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-3611

Url: https://www.debian.org/security/2023/dsa-5492

Url: https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html

Url: https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html

Url: https://kernel.dance/3e337087c3b5805fe0b8a46ba622a962880b5d64

Url: https://security.netapp.com/advisory/ntap-20230908-0002/

Url: https://www.debian.org/security/2023/dsa-5480

Url: https://access.redhat.com/security/cve/CVE-2023-3611

Url: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64

Url: https://www.mend.io/vulnerability-database/CVE-2023-3611

Severity Score

7.8

Weakness Type (CWE)

Out-of-bounds Write

CWE-787

Top Fix

Upgrade Version

Upgrade to version v5.10.188,v5.15.121,v6.1.40,v6.4.5,v6.5-rc2

Learn More

CVSS v3.1

Base Score:	7.8
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2023-3611

Good to know:

Date: July 21, 2023

Language: C

Severity Score

Related Resources (10)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?