AZL-28779

Dashboard / Vulnerabilities / AZL-28779

AZL-28779

Summary: CVE-2023-4921 affecting package kernel for versions less than 5.15.133.1-1

Details: A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

References: https://nvd.nist.gov/vuln/detail/CVE-2023-4921