In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/[email protected]/
Update Linux/Linux to bc4e5bb529823a09f02dbe96169de679a9db26e0; Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to *; Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to *; Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to *; Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to *; Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP to *; Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP to * if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scannet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks affects Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic), Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (generic). Severity is high. In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/[email protected]/
AI coding agents often install or upgrade packages automatically in generic. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/[email protected]/
Update Linux/Linux to bc4e5bb529823a09f02dbe96169de679a9db26e0; Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to *; Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to *; Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to *; Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to *; Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP to *; Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP to * if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scannet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks affects Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic), Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (generic). Severity is high. In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/[email protected]/
AI coding agents often install or upgrade packages automatically in generic. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=172ba7d46c202e679f3ccb10264c67416aaeb1c4 <bc4e5bb529823a09f02dbe96169de679a9db26e0 || >=0b5b831122fc3789fff75be433ba3e4dd7b779d4 <fb3c380a54e33d1fd272cc342faa906d787d7ef1 || >=73f7da5fd124f2cda9161e2e46114915e6e82e97 <5a110ddcc99bda77a28598b3555fe009eaab3828 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <524ce8b4ea8f64900b6c52b6a28df74f6bc0801e || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <9deda0fcda5c1f388c5e279541850b71a2ccfcf4 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <11cb63b0d1a0685e0831ae3c77223e002ef18189 || f5346df0591d10bc948761ca854b1fae6d2ef441 || >=5.15.148 <5.15.203 || >=6.1.75 <6.1.167 || >=6.6.14 <6.6.130 || >=6.7.2 <6.8 | bc4e5bb529823a09f02dbe96169de679a9db26e0, fb3c380a54e33d1fd272cc342faa906d787d7ef1, 5a110ddcc99bda77a28598b3555fe009eaab3828, 524ce8b4ea8f64900b6c52b6a28df74f6bc0801e, 380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6, 9deda0fcda5c1f388c5e279541850b71a2ccfcf4, 11cb63b0d1a0685e0831ae3c77223e002ef18189, 5.15.203, 6.1.167, 6.6.130, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by CVE List V5 (cvelist).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=172ba7d46c202e679f3ccb10264c67416aaeb1c4 <bc4e5bb529823a09f02dbe96169de679a9db26e0 || >=0b5b831122fc3789fff75be433ba3e4dd7b779d4 <fb3c380a54e33d1fd272cc342faa906d787d7ef1 || >=73f7da5fd124f2cda9161e2e46114915e6e82e97 <5a110ddcc99bda77a28598b3555fe009eaab3828 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <524ce8b4ea8f64900b6c52b6a28df74f6bc0801e || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <9deda0fcda5c1f388c5e279541850b71a2ccfcf4 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <11cb63b0d1a0685e0831ae3c77223e002ef18189 || f5346df0591d10bc948761ca854b1fae6d2ef441 || >=5.15.148 <5.15.203 || >=6.1.75 <6.1.167 || >=6.6.14 <6.6.130 || >=6.7.2 <6.8 | bc4e5bb529823a09f02dbe96169de679a9db26e0, fb3c380a54e33d1fd272cc342faa906d787d7ef1, 5a110ddcc99bda77a28598b3555fe009eaab3828, 524ce8b4ea8f64900b6c52b6a28df74f6bc0801e, 380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6, 9deda0fcda5c1f388c5e279541850b71a2ccfcf4, 11cb63b0d1a0685e0831ae3c77223e002ef18189, 5.15.203, 6.1.167, 6.6.130, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by CVE List V5 (cvelist).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard