Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 9 Jan 2023 15:09:22 -0700
From: Kyle Zeng <>
Subject: Type Confusion in Linux Kernel

Hi there,

I recently found a type-confusion vulnerability in the Linux kernel.
Since it interprets random data as pointers, it is potentially
exploitable. According to the fix commit, this bug was introduced in
Linux-2.6.12-rc2 in 2005. I already contacted and
helped them patch the vulnerability.

# Vulnerability
The vulnerability is caused by accessing classification results before
checking the classification return code in the network scheduler's
code. For example, in the following snippet from `cbq_classify`:
struct cbq_class *cl;
result = tcf_classify(skb, fl, &res, true);
if (!fl || result < 0)
goto fallback;

cl = (void *)res.class;
It checks `result < 0` before casting `res.class` to `struct cbq_class
*`. However, `result >= 0` does not ensure `res.class` contains valid
results. Specifically, it is possible `result` itself says the packet
is invalid and should be dropped (`TC_ACT_SHOT`) while at the same
time res.class contains invalid data because res.class is a huge union
attribute and can be used for other purposes before it is marked as
`TC_ACT_SHOT`. As a result, it is a type confusion between `struct
cbq_class` and whatever struct that res.class was used as before it is

# Patch
Two schedulers have the same vulnerable code patterns and the fixes
can be found

This vulnerability does not have a CVE assigned. I'll appreciate it if
anyone on the mailing list can give it a CVE to signify its security

Kyle Zeng

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.