CVE-2024-36974 Information

Description

In the Linux kernel the following vulnerability has been resolved:

net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided taprio_parse_mqprio_opt() must validate it or userspace can inject arbitrary data to the kernel the second time taprio_change() is called.

First call (with valid attributes) sets dev->num_tc to a non zero value.

Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.

Reference

https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36