CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
In the Linux kernel, the following vulnerability has been resolved:
net: sched: schmultiq: fix possible OOB write in multiqtune()
q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: sched: schmultiq: fix possible OOB write in multiqtune()
The Linux kernel CVE team has assigned CVE-2024-36978 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061926-CVE-2024-36978-b4b8@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an out--of-bounds write in multiqtune(). A local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-36978 - Compensating control
For kernels that are not yet patched, mitigate the potential out-of-bounds write in net/sched sch_multiq multiq_tune() by ensuring affected systems are isolated from untrusted locally authenticated users until the fix for CVE-2024-36978 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36978?
CVE-2024-36978 has been assigned a severity level that indicates it can potentially lead to an out-of-bounds write in the Linux kernel.
How do I fix CVE-2024-36978?
To fix CVE-2024-36978, update the Linux kernel to a version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-36978?
CVE-2024-36978 affects multiple versions of the Linux kernel, particularly those prior to version 6.10.
Is CVE-2024-36978 present in Google Android?
Yes, CVE-2024-36978 may affect certain versions of Google Android that rely on vulnerable Linux kernel versions.
What is the nature of CVE-2024-36978?
CVE-2024-36978 is a vulnerability in the network scheduler of the Linux kernel that can lead to a potential out-of-bounds write.