CVE-2024-46828

What it actually does

Incorrect conditional logic on bulk flow counter decrements in sch_cake allows a spurious U16_MAX wrap-around on hash collisions when host fairness is disabled; re-enabling host fairness then uses the wrapped value as an array index, resulting in out-of-bounds memory access.

Why it matters to the business

Systems running affected Linux kernels with CAKE qdisc can experience kernel memory corruption, crashes, or local privilege escalation under specific traffic-shaping configurations, increasing operational risk for network appliances and servers that rely on host-fairness modes.

How an attack unfolds

An attacker with local privileges configures the CAKE qdisc with host fairness disabled, triggers hash collisions via crafted packets, forces a counter wrap-around, then re-enables host fairness to cause an out-of-bounds access; threat actors in espionage and financially motivated campaigns have targeted similar Linux kernel resource and bounds issues.

How to fix it

Upgrade the Linux kernel to commit 4a4eeefa514db570be025ab46d779af180e2c9bb or later stable releases containing the fix; rebuild and reboot with the corrected sch_cake implementation. For Go stdlib consumers, update to version 1.5.4 or newer.

How to confirm the fix worked

Verify kernel version contains commit 4a4eeefa514db570be025ab46d779af180e2c9bb, confirm sch_cake source shows conditional decrement matching the increment path, and test that host-fairness reconfiguration after hash collisions no longer produces counter wrap-around or oops.

Typical attack path

1. Obtain local access or privileges on target system
2. Load or attach sch_cake qdisc with host_fairness disabled
3. Generate traffic patterns that produce hash collisions on the set-associative buckets
4. Reconfigure qdisc to enable host fairness mode
5. Trigger use of the corrupted bulk-flow counter as an array index

How to detect it

Review kernel logs for sch_cake oops or array-index warnings after qdisc reconfiguration; inspect audit logs for tc commands that disable then re-enable host fairness; correlate with packet captures showing repeated hash-bucket collisions on affected interfaces.

• sch_cake.*bulk.*wrap
• host_fairness.*U16_MAX
• tc qdisc.*cake.*hostfair
• kernel: general protection fault.*sch_cake

What your security team should do

• Prioritize kernel updates on all systems using CAKE qdisc with host fairness
• Audit network configurations for any use of sch_cake host_fairness mode
• Monitor for local privilege-escalation attempts targeting kernel qdiscs
• Apply the fix before the CISA-style deadlines referenced in similar kernel issues