REDHAT-BUG-2389507: Medium severity linux/kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
TCAMQPRIOTCENTRYINDEX is validated using NLAPOLICYMAX(NLAU32, TCQOPTMAXQUEUE), which allows the value TCQOPTMAXQUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (0–15).
Fix this by changing the policy to allow only up to TCQOPTMAXQUEUE - 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the mqprio policy to allow only up to TC_QOPT_MAX_QUEUE - 1 so that TCA_MQPRIO_TC_ENTRY_INDEX is validated against TC_QOPT_MAX_QUEUE - 1 rather than TC_QOPT_MAX_QUEUE (16), preventing the 4-byte out-of-bounds stack write in the fp[] array (0–15).
Linux kernel net/sched mqprio NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE) = NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE - 1)