CVE-2023-31436: Linux Kernel Buffer Overflow Vulnerability

CVE-2023-31436 Overview

CVE-2023-31436 is an out-of-bounds write vulnerability in the Linux kernel's Quick Fair Queueing (QFQ) packet scheduler. The flaw resides in the qfq_change_class function within net/sched/sch_qfq.c and affects Linux kernel versions before 6.2.13. Local attackers with the ability to configure traffic control (tc) qdiscs can supply an lmax value that exceeds QFQ_MIN_LMAX, triggering memory corruption [CWE-787]. The vulnerability enables local privilege escalation by corrupting kernel memory adjacent to QFQ aggregate structures.

Critical Impact
Local attackers with CAP_NET_ADMIN in a user namespace can write out-of-bounds in kernel memory, potentially escalating to root privileges through controlled heap corruption.

Affected Products

Linux Kernel versions prior to 6.2.13
Debian distributions (addressed in DSA-5402)
NetApp products referencing advisory NTAP-20230609-0001

Discovery Timeline

2023-04-28 - CVE-2023-31436 published to NVD
2023-04-28 - Linux kernel 6.2.13 released containing the fix (commit 3037933448f6)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-31436

Vulnerability Analysis

The QFQ qdisc is a Linux traffic scheduler implementing Quick Fair Queueing. When userspace creates or modifies a QFQ class using tc commands, the kernel invokes qfq_change_class to parse the netlink attributes. The function reads the TCA_QFQ_LMAX attribute to set the maximum packet length for the class.

In vulnerable kernels, the validation that ensures lmax falls between QFQ_MIN_LMAX and 1 << QFQ_MTU_SHIFT only ran when userspace explicitly supplied TCA_QFQ_LMAX. When the attribute was absent, the kernel computed lmax from psched_mtu() and skipped the bounds check entirely. A device with an MTU below QFQ_MIN_LMAX therefore propagated an undersized lmax into the aggregate lookup logic.

Subsequent calls into qfq_activate_agg indexed arrays sized for valid lmax values, producing a slab-out-of-bounds write [CWE-787]. The corruption primitive sits adjacent to scheduler aggregate metadata, providing attackers a path to overwrite function pointers or adjacent kernel objects.

Root Cause

The root cause is missing input validation on a code path. The bounds check for lmax was conditionally executed only inside the if (tb[TCA_QFQ_LMAX]) branch. Values derived from psched_mtu(qdisc_dev(sch)) bypassed validation entirely.

Attack Vector

Exploitation requires local access and CAP_NET_ADMIN capability within a network namespace. On systems where unprivileged user namespaces are enabled, any local user can obtain this capability and reach the vulnerable code by creating a network device with an MTU smaller than QFQ_MIN_LMAX and attaching a QFQ qdisc to it.

 	} else
 		weight = 1;
 
-	if (tb[TCA_QFQ_LMAX]) {
+	if (tb[TCA_QFQ_LMAX])
 		lmax = nla_get_u32(tb[TCA_QFQ_LMAX]);
-		if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
-			pr_notice("qfq: invalid max length %u\n", lmax);
-			return -EINVAL;
-		}
-	} else
+	else
 		lmax = psched_mtu(qdisc_dev(sch));
 
+	if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
+		pr_notice("qfq: invalid max length %u\n", lmax);
+		return -EINVAL;
+	}
+
 	inv_w = ONE_FP / weight;
 	weight = ONE_FP / inv_w;

The patch relocates the bounds check outside the conditional so both the netlink-supplied and MTU-derived lmax values are validated. Source: GitHub Linux Commit 30379334.

Detection Methods for CVE-2023-31436

Indicators of Compromise

Kernel log messages containing qfq: invalid max length indicating attempted exploitation against patched kernels
Unexpected tc qdisc add ... qfq invocations from non-administrative users or container workloads
Creation of network interfaces with MTU values below 512 bytes followed by QFQ qdisc attachment
Kernel oops or KASAN slab-out-of-bounds reports referencing qfq_activate_agg or qfq_change_class

Detection Strategies

Audit auditd and execve telemetry for tc qdisc commands specifying qfq from unprivileged contexts
Monitor unshare and clone syscalls that create new user and network namespaces immediately followed by netlink traffic control activity
Inspect dmesg output for kernel warnings originating from the sch_qfq module

Monitoring Recommendations

Inventory running kernel versions across the fleet and flag hosts running Linux kernels older than 6.2.13 or unpatched LTS branches
Track use of unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 and alerting on attempts to bypass the restriction
Forward kernel ring buffer messages to a centralized logging pipeline for correlation against process execution data

How to Mitigate CVE-2023-31436

Immediate Actions Required

Upgrade to Linux kernel 6.2.13 or later, or apply the distribution backport containing commit 3037933448f6
Apply vendor patches from Debian (DSA-5402), Ubuntu (LSN-0095, LSN-0096, LSN-0099), and NetApp (NTAP-20230609-0001)
Restrict unprivileged user namespace creation on hosts that do not require it
Blacklist the sch_qfq kernel module on systems that do not use QFQ scheduling

Patch Information

The upstream fix is commit 3037933448f6, included in Linux 6.2.13 per the Linux Kernel ChangeLog 6.2.13. Stable backports were distributed through the Spinics Stable Commits Message and incorporated by major distributions including Debian Security Advisory DSA-5402 and the Debian LTS Security Announcement.

Workarounds

Set sysctl -w kernel.unprivileged_userns_clone=0 to prevent unprivileged users from gaining CAP_NET_ADMIN in new namespaces
Add install sch_qfq /bin/true to /etc/modprobe.d/disable-qfq.conf to block module autoloading
Enforce seccomp or AppArmor profiles that deny the setsockopt, sendmsg, and netlink calls used to configure tc qdiscs from untrusted workloads

bash

# Disable unprivileged user namespaces and blacklist the vulnerable module
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2023-31436.conf
echo 'install sch_qfq /bin/true' > /etc/modprobe.d/disable-qfq.conf
# Verify the running kernel meets the fixed version
uname -r