In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: always validate TCATAPRIOATTR_PRIOMAP
If one TCATAPRIOATTRPRIOMAP attribute has been provided, taprioparsemqprioopt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called.
First call (with valid attributes) sets dev->num_tc to a non zero value.
Second call (with arbitrary mqprio attributes) returns early from taprioparsemqprio_opt() and bad things can happen.
[
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-1402d1bb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277632397901420980351418708389823768891",
"27616020755783587745419995707558661780",
"139082996751133074891542707687838005583",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"179251199892779007774265948115623139724",
"150510863509816028209956324317725720171",
"217372586485615676181358554171209441893"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3dde4c217f0c31ab0621912e682b57e677dd923"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-15a4cd6a",
"digest": {
"function_hash": "79568554522078745449594147358735249103",
"length": 489.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c37a27a35eadb59286c9092c49c241270c802ae2"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-394cacb3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277632397901420980351418708389823768891",
"27616020755783587745419995707558661780",
"139082996751133074891542707687838005583",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"179251199892779007774265948115623139724",
"150510863509816028209956324317725720171",
"217372586485615676181358554171209441893"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf6cc96612bd396048f57d63f1ad454a846e39c"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-46e72437",
"digest": {
"threshold": 0.9,
"line_hashes": [
"46984414989827697853393687367784692825",
"316111346680439628519271001525399031276",
"273615356267291040555332940874845382286",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"7999900361195065713278621487231180244",
"146969993873533008634759666768411580723",
"319967941350444418400098484815101416363"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f921a58ae20852d188f70842431ce6519c4fdc36"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-5977a369",
"digest": {
"function_hash": "5352379984178267061998332356364979205",
"length": 1349.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6041e7124464ce7e896ee3f912897ce88a0c4ec"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-6e83ee1a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277632397901420980351418708389823768891",
"27616020755783587745419995707558661780",
"139082996751133074891542707687838005583",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"179251199892779007774265948115623139724",
"150510863509816028209956324317725720171",
"217372586485615676181358554171209441893"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db4af09987cc5d5f0136bd46148b0e0460dae5b"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-784a5047",
"digest": {
"function_hash": "79568554522078745449594147358735249103",
"length": 489.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@724050ae4b76e4fae05a923cb54101d792cf4404"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-8892d140",
"digest": {
"function_hash": "5352379984178267061998332356364979205",
"length": 1349.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db4af09987cc5d5f0136bd46148b0e0460dae5b"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-8f13d06d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277632397901420980351418708389823768891",
"27616020755783587745419995707558661780",
"139082996751133074891542707687838005583",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"179251199892779007774265948115623139724",
"150510863509816028209956324317725720171",
"217372586485615676181358554171209441893"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6041e7124464ce7e896ee3f912897ce88a0c4ec"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-af840944",
"digest": {
"function_hash": "5352379984178267061998332356364979205",
"length": 1349.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3dde4c217f0c31ab0621912e682b57e677dd923"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-c14414da",
"digest": {
"function_hash": "5352379984178267061998332356364979205",
"length": 1349.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf6cc96612bd396048f57d63f1ad454a846e39c"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-d006f78b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"46984414989827697853393687367784692825",
"316111346680439628519271001525399031276",
"273615356267291040555332940874845382286",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"7999900361195065713278621487231180244",
"146969993873533008634759666768411580723",
"319967941350444418400098484815101416363"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@724050ae4b76e4fae05a923cb54101d792cf4404"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_parse_mqprio_opt"
},
"signature_version": "v1",
"id": "CVE-2024-36974-dad896ef",
"digest": {
"function_hash": "79568554522078745449594147358735249103",
"length": 489.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f921a58ae20852d188f70842431ce6519c4fdc36"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_taprio.c"
},
"signature_version": "v1",
"id": "CVE-2024-36974-ef455e8f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"46984414989827697853393687367784692825",
"316111346680439628519271001525399031276",
"273615356267291040555332940874845382286",
"36323305394094887222009703065378025073",
"57851588267396673356296790707490261670",
"64294876099216556170604176372753518763",
"7999900361195065713278621487231180244",
"146969993873533008634759666768411580723",
"319967941350444418400098484815101416363"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c37a27a35eadb59286c9092c49c241270c802ae2"
}
]