net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided,
taprio_parse_mqprio_opt() must validate it, or userspace
can inject arbitrary data to the kernel, the second time
taprio_change() is called.
First call (with valid attributes) sets dev->num_tc
to a non zero value.
Second call (with arbitrary mqprio attributes)
returns early from taprio_parse_mqprio_opt()
and bad things can happen.
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-5730-1 | linux security update |
Ubuntu USN |
USN-6999-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-6999-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-5 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7004-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7005-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7005-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7006-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7007-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7007-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7007-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7008-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7009-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7009-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7019-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7029-1 | Linux kernel vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Wed, 01 Oct 2025 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Wed, 13 Nov 2024 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat
Redhat enterprise Linux |
|
| CPEs | cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux |
Tue, 05 Nov 2024 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Sep 2024 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Sep 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-05-04T09:13:10.176Z
Reserved: 2024-05-30T15:25:07.082Z
Link: CVE-2024-36974
Updated: 2024-08-02T03:43:50.561Z
Status : Analyzed
Published: 2024-06-18T20:15:13.257
Modified: 2025-10-01T15:15:45.857
Link: CVE-2024-36974
OpenCVE Enrichment
No data.
Debian DSA
Ubuntu USN