In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attributes) sets dev->num_tc to a non zero value. Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Redhat
  • Enterprise Linux

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:9315 2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5 cpe:/o:redhat:enterprise_linux:9 RHSA-2024:9315 2024-11-12T00:00:00Z
References
Link Providers
https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c cve-icon cve-icon
https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b cve-icon cve-icon
https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 cve-icon cve-icon
https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 cve-icon cve-icon
https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec cve-icon cve-icon
https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 cve-icon cve-icon
https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024061810-CVE-2024-36974-a482@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-36974 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-36974 cve-icon
History

Wed, 13 Nov 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Tue, 05 Nov 2024 10:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-18T19:15:07.892Z

Updated: 2024-11-05T09:29:08.949Z

Reserved: 2024-05-30T15:25:07.082Z

Link: CVE-2024-36974

cve-icon Vulnrichment

Updated: 2024-08-02T03:43:50.561Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-06-18T20:15:13.257

Modified: 2024-07-05T08:15:02.943

Link: CVE-2024-36974

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-06-18T00:00:00Z

Links: CVE-2024-36974 - Bugzilla