Security readout for executives and security teams
Plain-English summary
CVE-2023-3611 is a Linux kernel flaw in the QFQ traffic scheduler. A local low-privileged user could potentially turn memory corruption into root-level control. This is high urgency for shared Linux systems, hosting platforms, and appliances using affected vendor kernels, but the provided sources do not show known active exploitation.
Executive priority
Treat this as a high-priority patching item for Linux fleets where local users, hosted workloads, or compromised services could attempt privilege escalation. It is less urgent than a remotely exploitable internet-facing bug, but it can convert a limited foothold into full system compromise.
Technical view
The issue is a CWE-787 out-of-bounds write in net/sched/sch_qfq.c. qfq_change_agg() updates lmax from packet sizes without sufficient bounds checking, enabling local privilege escalation. The CVSS 3.1 score is 7.8 with local attack vector, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on Linux systems running vulnerable kernel builds or vendor backports before the fix. Internet reachability is not the primary driver; local account, workload, or container access matters more. Debian and NetApp advisories indicate downstream vendor impact, but exact exposure depends on their package or product guidance.
Exploitation context
The source bundle supports local privilege escalation risk, not remote exploitation. CISA KEV status is false, and no provided source claims active exploitation. Attackers would need local low-privileged access or a foothold that can interact with the affected kernel functionality.
Researcher notes
The strongest evidence is the Linux kernel patch reference and CVE description naming sch_qfq.c and qfq_change_agg(). The source bundle names Linux kernel 3.8 with defaultStatus unaffected for other versions, but vendor advisories show downstream tracking. Avoid assuming exploit availability or affected product scope beyond cited advisories.
Mitigation direction
- Upgrade to a kernel containing or backporting commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.
- Apply relevant Debian security updates if using affected Debian kernel packages.
- Check NetApp advisory guidance for affected NetApp products and fixed releases.
- Prioritize shared-user, multi-tenant, CI, hosting, and appliance environments.
- Use vendor advisories for mitigations not explicitly named in the source bundle.
Validation and detection
- Inventory Linux kernel packages and vendor appliance firmware versions.
- Confirm the fix commit or vendor backport is present in deployed kernels.
- Map systems where untrusted local users or workloads have access.
- Review Debian DSA-5480, DSA-5492, and LTS notices for package applicability.
- Track vendor advisories until all affected kernels or products are updated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-3611 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64CVE reference · patch
- https://kernel.dance/3e337087c3b5805fe0b8a46ba622a962880b5d64CVE reference
- https://www.debian.org/security/2023/dsa-5480CVE reference
- https://security.netapp.com/advisory/ntap-20230908-0002/CVE reference
- https://www.debian.org/security/2023/dsa-5492CVE reference
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlCVE reference
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.