Vulnerability identifier: #VU93310

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36974

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the taprio_parse_mqprio_opt() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36
http://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c
http://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404
http://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2
http://ssd-disclosure.com/ssd-advisory-linux-kernel-taprio-oob

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.