In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: always validate TCATAPRIOATTR_PRIOMAP
If one TCATAPRIOATTRPRIOMAP attribute has been provided, taprioparsemqprioopt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called.
First call (with valid attributes) sets dev->num_tc to a non zero value.
Second call (with arbitrary mqprio attributes) returns early from taprioparsemqprio_opt() and bad things can happen.
[ { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3dde4c217f0c31ab0621912e682b57e677dd923", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "277632397901420980351418708389823768891", "27616020755783587745419995707558661780", "139082996751133074891542707687838005583", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "179251199892779007774265948115623139724", "150510863509816028209956324317725720171", "217372586485615676181358554171209441893" ] }, "id": "CVE-2024-36974-1402d1bb" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c37a27a35eadb59286c9092c49c241270c802ae2", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "79568554522078745449594147358735249103", "length": 489.0 }, "id": "CVE-2024-36974-15a4cd6a" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf6cc96612bd396048f57d63f1ad454a846e39c", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "277632397901420980351418708389823768891", "27616020755783587745419995707558661780", "139082996751133074891542707687838005583", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "179251199892779007774265948115623139724", "150510863509816028209956324317725720171", "217372586485615676181358554171209441893" ] }, "id": "CVE-2024-36974-394cacb3" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f921a58ae20852d188f70842431ce6519c4fdc36", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46984414989827697853393687367784692825", "316111346680439628519271001525399031276", "273615356267291040555332940874845382286", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "7999900361195065713278621487231180244", "146969993873533008634759666768411580723", "319967941350444418400098484815101416363" ] }, "id": "CVE-2024-36974-46e72437" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6041e7124464ce7e896ee3f912897ce88a0c4ec", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "5352379984178267061998332356364979205", "length": 1349.0 }, "id": "CVE-2024-36974-5977a369" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db4af09987cc5d5f0136bd46148b0e0460dae5b", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "277632397901420980351418708389823768891", "27616020755783587745419995707558661780", "139082996751133074891542707687838005583", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "179251199892779007774265948115623139724", "150510863509816028209956324317725720171", "217372586485615676181358554171209441893" ] }, "id": "CVE-2024-36974-6e83ee1a" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@724050ae4b76e4fae05a923cb54101d792cf4404", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "79568554522078745449594147358735249103", "length": 489.0 }, "id": "CVE-2024-36974-784a5047" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db4af09987cc5d5f0136bd46148b0e0460dae5b", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "5352379984178267061998332356364979205", "length": 1349.0 }, "id": "CVE-2024-36974-8892d140" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6041e7124464ce7e896ee3f912897ce88a0c4ec", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "277632397901420980351418708389823768891", "27616020755783587745419995707558661780", "139082996751133074891542707687838005583", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "179251199892779007774265948115623139724", "150510863509816028209956324317725720171", "217372586485615676181358554171209441893" ] }, "id": "CVE-2024-36974-8f13d06d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3dde4c217f0c31ab0621912e682b57e677dd923", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "5352379984178267061998332356364979205", "length": 1349.0 }, "id": "CVE-2024-36974-af840944" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf6cc96612bd396048f57d63f1ad454a846e39c", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "5352379984178267061998332356364979205", "length": 1349.0 }, "id": "CVE-2024-36974-c14414da" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@724050ae4b76e4fae05a923cb54101d792cf4404", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46984414989827697853393687367784692825", "316111346680439628519271001525399031276", "273615356267291040555332940874845382286", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "7999900361195065713278621487231180244", "146969993873533008634759666768411580723", "319967941350444418400098484815101416363" ] }, "id": "CVE-2024-36974-d006f78b" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f921a58ae20852d188f70842431ce6519c4fdc36", "signature_version": "v1", "target": { "function": "taprio_parse_mqprio_opt", "file": "net/sched/sch_taprio.c" }, "digest": { "function_hash": "79568554522078745449594147358735249103", "length": 489.0 }, "id": "CVE-2024-36974-dad896ef" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c37a27a35eadb59286c9092c49c241270c802ae2", "signature_version": "v1", "target": { "file": "net/sched/sch_taprio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46984414989827697853393687367784692825", "316111346680439628519271001525399031276", "273615356267291040555332940874845382286", "36323305394094887222009703065378025073", "57851588267396673356296790707490261670", "64294876099216556170604176372753518763", "7999900361195065713278621487231180244", "146969993873533008634759666768411580723", "319967941350444418400098484815101416363" ] }, "id": "CVE-2024-36974-ef455e8f" } ]