Executive Summary

This vulnerability exists in the Linux kernel's network scheduler component, specifically in the cls_flow module. The issue arises because the function flow_change() calls tcf_block_q() and dereferences q->handle to get a default baseclass. However, when dealing with shared blocks, block->q is NULL, which leads to a NULL pointer dereference if a flow filter without a fully qualified baseclass is created on such a shared block.

The fix involves checking if the block is shared using tcf_block_shared() before accessing block->q, and returning an error (-EINVAL) for shared blocks to avoid the NULL pointer dereference.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a NULL pointer dereference in the Linux kernel, which may lead to a kernel crash or denial of service (DoS). Such a crash could disrupt network traffic handling and potentially affect system stability or availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes a NULL pointer dereference in the Linux kernel's traffic control flow classifier (cls_flow) when handling shared blocks without a fully qualified baseclass.

Detection can be done by monitoring kernel logs for messages indicating a NULL pointer dereference related to flow_change in net/sched/cls_flow.c, such as KASAN reports showing null-ptr-deref at flow_change.

You can check kernel logs using commands like:

• dmesg | grep -i 'null-ptr-deref'
• journalctl -k | grep -i 'flow_change'
• journalctl -k | grep -i 'cls_flow'

Additionally, monitoring for crashes or kernel oops related to net/sched or rtnetlink components may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by checking for shared blocks before dereferencing pointers in the flow classifier code, avoiding NULL pointer dereferences.

Immediate mitigation steps include:

• Update the Linux kernel to a version that includes the fix for this vulnerability.
• Avoid creating flow filters without fully qualified baseclasses on shared blocks until the patch is applied.
• Monitor kernel logs for signs of crashes or NULL pointer dereferences related to cls_flow and take appropriate action.

Useful 0 Not Useful 0