CVE-2024-36974

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36974
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attributes) sets dev->num_tc to a non zero value. Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c Patch
https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b Patch
https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 Patch
https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 Patch
https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec Patch
https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 Patch
https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 Patch
https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c Patch
https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b Patch
https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 Patch
https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 Patch
https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec Patch
https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 Patch
https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
History

01 Oct 2025, 15:15

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c - () https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c - Patch
References () https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b - () https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b - Patch
References () https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 - () https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 - Patch
References () https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 - () https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 - Patch
References () https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec - () https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec - Patch
References () https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 - () https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 - Patch
References () https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 - () https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:22

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c - () https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c -
References () https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b - () https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b -
References () https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 - () https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 -
References () https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 - () https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 -
References () https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec - () https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec -
References () https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 - () https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 -
References () https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 - () https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36 -

05 Jul 2024, 08:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b -
  • () https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec -
  • () https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 -

21 Jun 2024, 14:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c -
  • () https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 -
  • () https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 -

20 Jun 2024, 12:44

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: taprio: validar siempre TCA_TAPRIO_ATTR_PRIOMAP Si se ha proporcionado un atributo TCA_TAPRIO_ATTR_PRIOMAP, taprio_parse_mqprio_opt() debe validarlo, o el espacio de usuario puede inyectar datos arbitrarios al kernel, la segunda vez taprio_change () se llama. La primera llamada (con atributos válidos) establece dev->num_tc en un valor distinto de cero. La segunda llamada (con atributos mqprio arbitrarios) regresa temprano desde taprio_parse_mqprio_opt() y pueden suceder cosas malas.

18 Jun 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-18 20:15

Updated : 2025-10-01 15:15

NVD link : CVE-2024-36974

Mitre link : CVE-2024-36974

CVE.ORG link : CVE-2024-36974

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo