Cloudanix VulnDB

CVE-2023-53624

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Oct 7, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration setting on certain network schedulers can be set too high, causing the system to freeze under light network use until the software is updated.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Signed integer overflow in credit assignment for sch_fq when initial_quantum exceeds INT_MAX, resulting in large negative credit values and CPU soft-lockup during flow processing.

Why it matters to the business

Attackers can trigger denial-of-service conditions on systems using the affected scheduler, disrupting network traffic handling with low effort and no elevated privileges required.

How an attack unfolds

An attacker with local access configures the sch_fq qdisc using an initial quantum value larger than INT_MAX, then creates sockets to instantiate new flows; the first credit assignment overflows, causing repeated negative credit and eventual soft-lockup warnings even with minimal sockets.

How to fix it

Upgrade affected packages to the fixed versions: asciidoctor (RubyGems) 1.5.8 or later. Validate that initial quantum values are capped at INT_MAX in fq_policy.

How to confirm the fix worked

Confirm the package version is 1.5.8 or newer, test sch_fq configuration with initial_quantum set to INT_MAX+1, and verify no overflow or soft-lockup occurs under load.

Typical attack path

  1. Obtain local access to a system using sch_fq
  2. Configure sch_fq with initial_quantum > INT_MAX via tc or equivalent
  3. Instantiate multiple sockets or flows to trigger credit assignment
  4. Observe CPU soft-lockup due to persistently negative credit

How to detect it

Review kernel logs for soft-lockup warnings mentioning sch_fq or credit, inspect tc qdisc show output for initial_quantum values, and correlate with process creation of new network flows.

What your security team should do

  • Prioritize patching systems exposing sch_fq configurations within the CISA remediation window if applicable
  • Audit all qdisc configurations for initial_quantum values exceeding INT_MAX
  • Monitor for soft-lockup warnings in kernel logs on hosts using sch_fq
  • Restrict unprivileged local access where feasible until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer overflow to a very negative value. In this situation, the syzkaller script provided by Cristoph triggers the CPU soft-lockup warning even with few sockets. It's not an infinite loop, but "credit" wasn't probably meant to be minus 2Gb for each new flow. Capping "initial quantum" to INT_MAX proved to fix the issue. v2: validation of "initial quantum" is done in fq_policy, instead of open coding in fq_change() _ suggested by Jakub Kicinski

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 3.12.0 5.10.180

Related vulnerabilities