CVE-2024-46828

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-46828", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.286Z", "datePublished": "2024-09-27T12:39:27.100Z", "dateUpdated": "2026-08-05T11:38:51.366Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:51.366Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: sch_cake: fix bulk flow accounting logic for host fairness\n\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\n\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\n\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\n\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\n\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\n\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won't apply\nbefore that."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through tc/netlink qdisc configuration (RTM_NEWQDISC/change on a cake qdisc) plus locally generated traffic; per kernel scoring guidance tc/qdisc netlink paths are Local. The mandatory reconfiguration step (host fairness off \u2192 collision \u2192 host fairness on) cannot be performed by a remote peer.\nAC:L - Every step is fully under the attacker's control and deterministic: configure the qdisc in `flows` mode, emit enough distinct 5-tuples to exhaust an 8-way hash set and force the collision, then `tc qdisc change` to `triple-isolate`; the number of collisions even selects the exact wrapped index. No race, memory layout, or victim state is involved.\nPR:L - Qdisc creation/modification is gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` which resolves to `ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)`, so an unprivileged local user obtains it with `unshare -Urn` and attaches cake to `lo` inside the new netns. Real root is not required.\nUI:N - The attacker performs the qdisc configuration, traffic generation, reconfiguration, and stats read entirely on their own; no action by any other user or administrator is needed.\nS:U - The out-of-bounds read and the resulting crash are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrapped `u16` counter yields an attacker-chosen index of up to 65535 into a 1025-entry global array, reading up to ~128 KB of adjacent kernel `.bss`/`.data`, and the value is propagated into `flow->deficit` which userspace reads back via `TCA_CAKE_STATS_DEFICIT` in `cake_dump_class_stats()` \u2014 a controlled-offset kernel memory disclosure that defeats KASLR and can leak arbitrary kernel globals.\nI:N - There is no out-of-bounds write: the only OOB access is the `quantum_div[]` load, and the counter decrements and `flow->deficit` store are all within bounds of the attacker's own qdisc state. No kernel data outside the attacker's own scheduling context is modified.\nA:H - `WARN_ON(host_load > CAKE_QUEUES)` in `cake_dequeue()` fires on every dequeue, producing a kernel oops and a panic on the widely deployed `panic_on_warn=1` configuration, and the ~128 KB read past a module's `.bss` can fault on unmapped vmalloc memory; under KASAN it is a global-out-of-bounds report."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_cake.c"], "versions": [{"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "4a4eeefa514db570be025ab46d779af180e2c9bb", "status": "affected", "versionType": "git"}, {"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "7725152b54d295b7da5e34c2f419539b30d017bd", "status": "affected", "versionType": "git"}, {"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "cde71a5677971f4f1b69b25e854891dbe78066a4", "status": "affected", "versionType": "git"}, {"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "549e407569e08459d16122341d332cb508024094", "status": "affected", "versionType": "git"}, {"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "d4a9039a7b3d8005b90c7b1a55a306444f0e5447", "status": "affected", "versionType": "git"}, {"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "d7c01c0714c04431b5e18cf17a9ea68a553d1c3c", "status": "affected", "versionType": "git"}, {"version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "546ea84d07e3e324644025e2aae2d12ea4c5896e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_cake.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.284", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.226", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.110", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.51", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.284"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.226"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.10.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4a4eeefa514db570be025ab46d779af180e2c9bb"}, {"url": "https://git.kernel.org/stable/c/7725152b54d295b7da5e34c2f419539b30d017bd"}, {"url": "https://git.kernel.org/stable/c/cde71a5677971f4f1b69b25e854891dbe78066a4"}, {"url": "https://git.kernel.org/stable/c/549e407569e08459d16122341d332cb508024094"}, {"url": "https://git.kernel.org/stable/c/d4a9039a7b3d8005b90c7b1a55a306444f0e5447"}, {"url": "https://git.kernel.org/stable/c/d7c01c0714c04431b5e18cf17a9ea68a553d1c3c"}, {"url": "https://git.kernel.org/stable/c/546ea84d07e3e324644025e2aae2d12ea4c5896e"}], "title": "sched: sch_cake: fix bulk flow accounting logic for host fairness", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-29T14:12:31.391068Z", "id": "CVE-2024-46828", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:12:40.796Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:19:16.846Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:19:16.846Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-29T14:12:31.391068Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:12:32.691Z"}}], "cna": {"title": "sched: sch_cake: fix bulk flow accounting logic for host fairness", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "4a4eeefa514db570be025ab46d779af180e2c9bb", "versionType": "git"}, {"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "7725152b54d295b7da5e34c2f419539b30d017bd", "versionType": "git"}, {"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "cde71a5677971f4f1b69b25e854891dbe78066a4", "versionType": "git"}, {"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "549e407569e08459d16122341d332cb508024094", "versionType": "git"}, {"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "d4a9039a7b3d8005b90c7b1a55a306444f0e5447", "versionType": "git"}, {"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "d7c01c0714c04431b5e18cf17a9ea68a553d1c3c", "versionType": "git"}, {"status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "lessThan": "546ea84d07e3e324644025e2aae2d12ea4c5896e", "versionType": "git"}], "programFiles": ["net/sched/sch_cake.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"status": "unaffected", "version": "0", "lessThan": "5.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.284", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.226", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.167", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.110", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.51", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.10", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sched/sch_cake.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4a4eeefa514db570be025ab46d779af180e2c9bb"}, {"url": "https://git.kernel.org/stable/c/7725152b54d295b7da5e34c2f419539b30d017bd"}, {"url": "https://git.kernel.org/stable/c/cde71a5677971f4f1b69b25e854891dbe78066a4"}, {"url": "https://git.kernel.org/stable/c/549e407569e08459d16122341d332cb508024094"}, {"url": "https://git.kernel.org/stable/c/d4a9039a7b3d8005b90c7b1a55a306444f0e5447"}, {"url": "https://git.kernel.org/stable/c/d7c01c0714c04431b5e18cf17a9ea68a553d1c3c"}, {"url": "https://git.kernel.org/stable/c/546ea84d07e3e324644025e2aae2d12ea4c5896e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: sch_cake: fix bulk flow accounting logic for host fairness\n\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\n\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\n\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\n\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\n\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\n\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won't apply\nbefore that."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.284", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.226", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.167", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.110", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.51", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.10", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "5.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T20:37:20.736Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46828", "state": "PUBLISHED", "dateUpdated": "2026-05-11T20:37:20.736Z", "dateReserved": "2024-09-11T15:12:18.286Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-27T12:39:27.100Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_cake.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4a4eeefa514db570be025ab46d779af180e2c9bb", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}, {"lessThan": "7725152b54d295b7da5e34c2f419539b30d017bd", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}, {"lessThan": "cde71a5677971f4f1b69b25e854891dbe78066a4", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}, {"lessThan": "549e407569e08459d16122341d332cb508024094", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}, {"lessThan": "d4a9039a7b3d8005b90c7b1a55a306444f0e5447", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}, {"lessThan": "d7c01c0714c04431b5e18cf17a9ea68a553d1c3c", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}, {"lessThan": "546ea84d07e3e324644025e2aae2d12ea4c5896e", "status": "affected", "version": "712639929912c5eefb09facccb48d55b3f72c9f8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_cake.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.284", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.226", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.167", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.110", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.51", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6215D739-B1A0-4E74-A311-9BF8E96145E6", "versionEndExcluding": "5.4.284", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "99182B6F-D005-4EA0-A29E-EE793EAF5494", "versionEndExcluding": "5.10.226", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA943118-D4CB-4C23-A051-06993A503CC8", "versionEndExcluding": "5.15.167", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD34EEF6-E0F8-42D6-BF92-8EB851A6ADEC", "versionEndExcluding": "6.1.110", "versionStartIncluding": "6.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "25B5F323-C9C2-4F67-BF42-0C5BDD860576", "versionEndExcluding": "6.6.51", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D16659A9-BECD-4E13-8994-B096652762E2", "versionEndExcluding": "6.10.10", "versionStartIncluding": "6.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*", "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*", "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*", "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: sch_cake: fix bulk flow accounting logic for host fairness\n\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\n\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\n\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\n\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\n\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\n\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won't apply\nbefore that."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched: sch_cake: arregla la l\u00f3gica de contabilidad de flujo masivo para la equidad del host En sch_cake, hacemos un seguimiento del recuento de flujos masivos activos por host, cuando se ejecuta en modo de equidad de host dst/src, que se utiliza como el peso round-robin cuando se itera a trav\u00e9s de flujos. El recuento de flujos masivos activos se actualiza siempre que un flujo cambia de estado. Esto tiene una interacci\u00f3n peculiar con el manejo de colisiones de hash: cuando ocurre una colisi\u00f3n de hash (despu\u00e9s del hash asociativo de conjuntos), el estado del dep\u00f3sito de hash simplemente se actualiza para que coincida con el nuevo paquete que colision\u00f3, y si la equidad del host est\u00e1 habilitada, eso tambi\u00e9n significa asignar un nuevo estado por host al flujo. Por este motivo, los contadores de flujo masivo de los host asignados al flujo se decrementan, antes de que se asigne un nuevo estado (y los contadores, que pueden no pertenecer m\u00e1s al mismo host, se incrementan nuevamente). Cuando se introdujo este c\u00f3digo, el modo de equidad del host siempre estaba habilitado, por lo que la disminuci\u00f3n era incondicional. Cuando se introdujeron los indicadores de configuraci\u00f3n, el *incremento* se hizo condicional, pero el *decremento* no. Lo que, por supuesto, puede conducir a un decremento espurio (y un retorno asociado a U16_MAX). AFAICT, cuando la equidad del host est\u00e1 deshabilitada, la disminuci\u00f3n y el retorno ocurren tan pronto como ocurre una colisi\u00f3n de hash (lo que no es tan com\u00fan en s\u00ed mismo, debido al hash asociativo de conjuntos). Sin embargo, en la mayor\u00eda de los casos esto es inofensivo, ya que el valor solo se usa cuando el modo de equidad del host est\u00e1 habilitado. Entonces, para activar un desbordamiento de matriz, sch_cake primero debe configurarse con la equidad del host deshabilitada y, mientras se ejecuta en este modo, debe ocurrir una colisi\u00f3n de hash para causar el desbordamiento. Luego, la qdisc debe reconfigurarse para habilitar la equidad del host, lo que lleva a que la matriz est\u00e9 fuera de los l\u00edmites porque el valor de retorno se conserva y se usa como un \u00edndice de matriz. Parece que syzbot logr\u00f3 activar esto, lo que es bastante impresionante en s\u00ed mismo. Este parche corrige el problema introduciendo la misma verificaci\u00f3n condicional en la disminuci\u00f3n que se usa en el incremento. El error original es anterior a la actualizaci\u00f3n de Cake, pero el commit que aparece en la etiqueta de correcciones abord\u00f3 ese c\u00f3digo, lo que significa que este parche no se aplicar\u00e1 antes de esa fecha."}], "id": "CVE-2024-46828", "lastModified": "2026-08-04T11:20:30.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46828", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-29T14:12:31.391068Z", "version": "2.0.3"}}]}, "published": "2024-09-27T13:15:15.220", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4a4eeefa514db570be025ab46d779af180e2c9bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/546ea84d07e3e324644025e2aae2d12ea4c5896e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/549e407569e08459d16122341d332cb508024094"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7725152b54d295b7da5e34c2f419539b30d017bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cde71a5677971f4f1b69b25e854891dbe78066a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d4a9039a7b3d8005b90c7b1a55a306444f0e5447"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d7c01c0714c04431b5e18cf17a9ea68a553d1c3c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: sched: sch_cake: fix bulk flow accounting logic for host fairness", "id": "2315180", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315180"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "verified"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsched: sch_cake: fix bulk flow accounting logic for host fairness\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won't apply\nbefore that."], "name": "CVE-2024-46828", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-46828\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46828\nhttps://lore.kernel.org/linux-cve-announce/2024092751-CVE-2024-46828-2184@gregkh/T"], "threat_severity": "Moderate"}

{}