CVE-2023-4921

What it actually does

Use-after-free in sch_qfq when plug qdisc is attached as a class, triggered by packet dequeue due to incorrect peek handler and missing error checks in agg_dequeue, allowing arbitrary kernel memory manipulation for local privilege escalation.

Why it matters to the business

Local attackers can gain root-level control on affected Linux systems, enabling full system compromise, data theft, or persistence without network access.

How an attack unfolds

An attacker with local shell access configures a qfq qdisc containing a plug class, then sends crafted network packets that invoke qfq_dequeue and trigger the use-after-free, allowing control of kernel execution flow to escalate privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 8fc134fee27f2263988ae38920bc03da416b03d8 or later; rebuild and reboot with the patched kernel. Disable or avoid use of qfq qdisc with plug classes as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Verify the running kernel contains commit 8fc134fee27f2263988ae38920bc03da416b03d8 via git log or version string; test by attempting the qdisc configuration and packet send sequence in a lab environment to confirm the use-after-free no longer occurs.

Typical attack path

1. Obtain local unprivileged shell on target Linux system
2. Create qfq qdisc and attach plug qdisc as a class
3. Send network packets to trigger dequeue path
4. Exploit freed memory for arbitrary read/write or code execution
5. Escalate to root privileges

How to detect it

Review kernel logs for oops or panic messages related to sch_qfq or qfq_dequeue; audit system logs for unusual tc qdisc add commands involving qfq and plug classes; inspect process execution history for traffic generation tools around the time of privilege changes.

What your security team should do

• Immediately identify all systems running vulnerable kernels and schedule kernel upgrades
• Prioritize patching on multi-user or internet-facing systems given public exploit availability
• Monitor kernel update channels for backports to supported distributions
• Restrict local user access and qdisc configuration privileges where possible