CVE-2022-47929: traffic control noqueue no problem?
Jan 31, 2023Frederick Lawler
Summary
This post details the discovery and analysis of a kernel bug (CVE-2022-47929) related to Linux Traffic Control's 'noqueue' discipline when used with classful qdiscs, exacerbated by USER namespaces. Cloudflare engineers identified how this vulnerability could lead to an unprivileged denial-of-service attack and contributed a fix by disallowing 'noqueue' for qdisc classes, enhancing the security and stability of the underlying infrastructure.
More from the Hardware Infrastructure & Performance Optimization trail
- How we reduced core unit boot time from hours to minutes
- A one-line Kubernetes fix that saved 600 hours a year
- Inside Gen 13- how we built our most powerful server yet
- Launching Cloudflare’s Gen 13 servers- trading cache for cores for 2x edge compute performance
- So long, and thanks for all the fish- how to escape the Linux networking stack