cbcvebase.
CVE-2024-56770
published 2025-01-08

CVE-2024-56770: In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any…

PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
18.3th percentile
In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated. If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix: qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
debianlinux-6.1< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
googlechrome_chrome
linuxlinux
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < 83c6ab12f08dcc09d4c5ac86fdb89736b28f1d3183c6ab12f08dcc09d4c5ac86fdb89736b28f1d31
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < 216509dda290f6db92c816dd54b83c1df9da9e76216509dda290f6db92c816dd54b83c1df9da9e76
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < c2047b0e216c8edce227d7c42f99ac2877dad0e4c2047b0e216c8edce227d7c42f99ac2877dad0e4
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < 10df49cfca73dfbbdb6c4150d859f7e8926ae42710df49cfca73dfbbdb6c4150d859f7e8926ae427
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < 3824c5fad18eeb7abe0c4fc966f29959552dca3e3824c5fad18eeb7abe0c4fc966f29959552dca3e
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < 356078a5c55ec8d2061fcc009fb8599f5b0527f9356078a5c55ec8d2061fcc009fb8599f5b0527f9
linuxlinux>= 50612537e9ab29693122fab20fc1eed235054ffe < f8d4bc455047cf3903cd6f85f49978987dbb3027f8d4bc455047cf3903cd6f85f49978987dbb3027
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.123-16.1.123-1
linuxlinux_kernel>= 0 < 6.12.6-16.12.6-1
linuxlinux_kernel>= 0 < 6.12.6-16.12.6-1
linuxlinux_kernel>= 0 < 5.4.0-211.2315.4.0-211.231
linuxlinux_kernel>= 0 < 5.15.0-135.1465.15.0-135.146
linuxlinux_kernel>= 0 < 6.8.0-60.636.8.0-60.63
linuxlinux_kernel>= 0 < 4.4.0-268.3024.4.0-268.302
linuxlinux_kernel>= 0 < 4.15.0-237.2494.15.0-237.249
linuxlinux_kernel>= 3.3 < 5.4.2885.4.288
linuxlinux_kernel>= 5.11 < 5.15.1755.15.175
linuxlinux_kernel>= 5.16 < 6.1.1216.1.121
linuxlinux_kernel>= 5.5 < 5.10.2325.10.232

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.