Junglewise Threat Intelligence

CVE-2024-36974: Linux Kernel taprio scheduler arbitrary data injection

CVE-2024-36974 · Severity: high · CVSS 7.8 · Published 2024-06-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system or potentially execute unauthorized commands. The issue exists in the 'taprio' scheduler, which manages network traffic timing. By sending specifically crafted configuration requests, an attacker can bypass security checks and inject arbitrary data into the kernel's memory.

Technical details

A vulnerability exists in net/sched/sch_taprio.c within the Linux kernel due to insufficient validation of the TCA_TAPRIO_ATTR_PRIOMAP attribute. In taprio_parse_mqprio_opt(), the code incorrectly returns early if dev->num_tc is already set (from a previous valid call), skipping validation for subsequent configuration changes. A local attacker with low privileges can exploit this by first making a valid call to set num_tc and then making a second call with malicious mqprio attributes. This allows the injection of arbitrary data into the kernel, potentially leading to memory corruption or privilege escalation. Patches have been released for various stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.9.y.

Affected products

  • Linux Linux Kernel 5.2 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.95, 6.2 to 6.6.35, 6.7 to 6.9.6

Timeline

  • 2024-06-04: disclosed: Vulnerability reported by Noam Rathaus
  • 2024-06-18: advisory: CVE published
  • 2024-06-21: patched: Fixes committed to stable kernel trees

References

Related threats