CVE-2023-23454

What it actually does

The vulnerability is a type confusion in cbq_classify allowing non-negative values to be misinterpreted as TC_ACT_SHOT, resulting in a slab-out-of-bounds read in the Linux kernel network scheduler.

Why it matters to the business

Linux systems may experience kernel crashes or service disruption, reducing availability for workloads that rely on traffic classification or network scheduling.

How an attack unfolds

A local attacker interacts with the CBQ scheduler through sockets or traffic control commands to supply classification results that trigger the type confusion, causing the out-of-bounds read and potential denial of service.

How to fix it

Upgrade the Linux kernel to include commit caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12 or apply the equivalent upstream patch; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit, review source for the corrected type handling in sch_cbq.c, and perform regression tests with traffic classification workloads.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Create or manipulate a CBQ qdisc and attach classification filters
3. Send crafted packets or issue tc commands that produce classification results interpretable as both valid and TC_ACT_SHOT
4. Trigger the slab-out-of-bounds read leading to kernel instability

How to detect it

Review kernel logs and dmesg for slab-out-of-bounds read warnings or oops originating from net/sched/sch_cbq.c; correlate with recent use of tc or CBQ qdisc configuration.

What your security team should do

• Prioritize kernel updates on all exposed or multi-tenant Linux hosts
• Limit untrusted local accounts and restrict use of traffic control interfaces
• Enable kernel hardening options such as slab freelist randomization
• Monitor for related kernel oops or panic reports