CVE-2023-31436

What it actually does

Out-of-bounds write in qfq_change_class due to lmax exceeding QFQ_MIN_LMAX in the Linux kernel QFQ scheduler, enabling memory corruption from local context.

Why it matters to the business

Local attackers on affected Linux systems can trigger crashes, denial of service, or potential privilege escalation, disrupting servers, containers, and network appliances until kernels are updated.

How an attack unfolds

An attacker with local access configures a qdisc class with an lmax value larger than the minimum allowed, causing the scheduler to perform an out-of-bounds write when the class is modified.

How to fix it

Upgrade the Linux kernel to version 6.2.13 or later, or apply commit f1b32fda06d2cfb8eea9680b0ba7a8b0d5b81eeb. Rebuild and reboot affected systems; prioritize hosts handling untrusted local workloads.

How to confirm the fix worked

Verify running kernel version is 6.2.13 or newer; confirm the patch commit is present in the source tree; test by attempting to configure an invalid lmax class and observing absence of the prior panic or corruption.

Typical attack path

1. Obtain local shell or process execution on a vulnerable Linux host
2. Load or modify the QFQ qdisc and create a class with crafted lmax parameter
3. Trigger qfq_change_class via tc or equivalent netlink call
4. Exploit resulting memory corruption for crash, data corruption, or code execution

How to detect it

Review kernel logs for oops/panic messages referencing sch_qfq or qfq_change_class; inspect auditd or syscall logs for unusual tc or netlink activity modifying qdisc classes.

What your security team should do

• Apply the kernel update immediately on all internet-facing or multi-tenant Linux systems
• Audit for use of the QFQ scheduler in production traffic policies and replace with safer alternatives where possible
• Monitor kernel update pipelines to ensure future releases are applied within 30 days