Linux Kernel Packet Duplication Vulnerability in Netem Scheduling

A vulnerability in the Linux kernel's network scheduling component, specifically within the netem (network emulator) module, has been addressed. This issue arose when netem duplicated a packet, re-enqueuing the copy at the root queue discipline (qdisc). If another netem instance was in the tree, the copy could be duplicated again, leading to excessive recursion that could exhaust system stack or memory resources. The initial safeguard against duplication only temporarily reset the per-qdisc duplicate state, which was not safe for concurrent enqueue operations. The vulnerability has been fixed by utilizing the skb (socket buffer) tc_depth field to track packet duplication more reliably. The tc_depth is incremented for duplicates before re-enqueuing, and any packet with a non-zero tc_depth is skipped, ensuring safe handling regardless of tree structure or concurrency.

Impact

The vulnerability could cause a denial-of-service condition by allowing packet duplication to recurse indefinitely, exhausting system resources.

Reproduction

The vulnerability can be reproduced by configuring a netem instance to duplicate packets and then re-enqueuing those duplicates at the root qdisc. If another netem instance is introduced in the scheduling tree, the duplicated packets can be re-duplicated, leading to a recursive loop that consumes stack or memory resources until they are exhausted.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the Linux kernel stable tree to address this vulnerability.