CVE-2024-26815: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: proper TCATAPRIOTCENTRYINDEX check
taprioparsetcentry() is not correctly checking TCATAPRIOTCENTRYINDEX attribute:
int tc; // Signed value
tc = nlagetu32(tb[TCATAPRIOTCENTRYINDEX]); if (tc >= TCQOPTMAXQUEUE) { NLSETERRMSGMOD(extack, "TC entry index out of range"); return -ERANGE; }
syzbot reported that it could fed arbitary negative values:
UBSAN: shift-out-of-bounds in net/sched/schtaprio.c:1722:18 shift exponent -2147418108 is negative CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x1e7/0x2e0 lib/dumpstack.c:106 ubsanepilogue lib/ubsan.c:217 [inline] ubsanhandleshiftoutofbounds+0x3c7/0x420 lib/ubsan.c:386 taprioparsetcentry net/sched/schtaprio.c:1722 [inline] taprioparsetcentries net/sched/schtaprio.c:1768 [inline] tapriochange+0xb87/0x57d0 net/sched/schtaprio.c:1877 taprioinit+0x9da/0xc80 net/sched/schtaprio.c:2134 qdisccreate+0x9d4/0x1190 net/sched/schapi.c:1355 tcmodifyqdisc+0xa26/0x1e40 net/sched/schapi.c:1776 rtnetlinkrcvmsg+0x885/0x1040 net/core/rtnetlink.c:6617 netlinkrcvskb+0x1e3/0x430 net/netlink/afnetlink.c:2543 netlinkunicastkernel net/netlink/afnetlink.c:1341 [inline] netlinkunicast+0x7ea/0x980 net/netlink/afnetlink.c:1367 netlinksendmsg+0xa3b/0xd70 net/netlink/afnetlink.c:1908 socksendmsgnosec net/socket.c:730 [inline] socksendmsg+0x221/0x270 net/socket.c:745 syssendmsg+0x525/0x7d0 net/socket.c:2584 syssendmsg net/socket.c:2638 [inline] syssendmsg+0x2b0/0x3a0 net/socket.c:2667 dosyscall64+0xf9/0x240 entrySYSCALL64afterhwframe+0x6f/0x77 RIP: 0033:0x7f1b2dea3759 Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIGRAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759 RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340 R13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: proper TCATAPRIOTCENTRYINDEX check
The Linux kernel CVE team has assigned CVE-2024-26815 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041006-CVE-2024-26815-7f4e@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.83 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-26815 - Configuration
In taprio_parse_tc_entry(), properly validate TCA_TAPRIO_TC_ENTRY_INDEX before using it: obtain tc from nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]) as an unsigned range check, and if tc >= TC_QOPT_MAX_QUEUE return -ERANGE while setting extack message "TC entry index out of range". This prevents syzbot-fed arbitrary negative values from reaching shift operations that caused UBSAN shift-out-of-bounds in net/sched/sch_taprio.c:1722:18.
Linux kernel net/sched taprio TCA_TAPRIO_TC_ENTRY_INDEX bounds check in taprio_parse_tc_entry() = if (tc >= TC_QOPT_MAX_QUEUE) { set NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range"); return -ERANGE; }
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26815?
CVE-2024-26815 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26815?
To mitigate CVE-2024-26815, update the Linux kernel to version 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9 or any supported fixed version from Debian.
Which Linux distributions are affected by CVE-2024-26815?
CVE-2024-26815 affects several versions of the Linux kernel used in Red Hat and Debian distributions.
What components are impacted by CVE-2024-26815?
CVE-2024-26815 specifically impacts the taprio component within the networking scheduler of the Linux kernel.
Can CVE-2024-26815 be exploited remotely?
Yes, CVE-2024-26815 can potentially be exploited remotely, making it critical to apply the necessary updates.