REDHAT-BUG-2389507: Medium severity linux/kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
TCAMQPRIOTCENTRYINDEX is validated using NLAPOLICYMAX(NLAU32, TCQOPTMAXQUEUE), which allows the value TCQOPTMAXQUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (0–15).
Fix this by changing the policy to allow only up to TCQOPTMAXQUEUE - 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the mqprio policy to allow only up to TC_QOPT_MAX_QUEUE - 1 so that TCA_MQPRIO_TC_ENTRY_INDEX is validated against TC_QOPT_MAX_QUEUE - 1 rather than TC_QOPT_MAX_QUEUE (16), preventing the 4-byte out-of-bounds stack write in the fp[] array (0–15).
Linux kernel net/sched mqprio NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE) = NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE - 1)
Event History
Frequently Asked Questions
What access is required to trigger this issue?
An attacker must be able to submit mqprio traffic-control configuration containing TCA_MQPRIO_TC_ENTRY_INDEX. The out-of-bounds write is reached when that index is set to 16.
Which configurations are affected?
Systems are affected where the kernel accepts mqprio traffic-control entry parsing with the vulnerable validation. The issue is specifically in validation of TCA_MQPRIO_TC_ENTRY_INDEX; valid fp[] array indices are 0 through 15.
Is there a temporary mitigation if an updated kernel cannot be installed immediately?
Avoid applying mqprio configurations that include TCA_MQPRIO_TC_ENTRY_INDEX with a value of 16. Restrict access to traffic-control configuration interfaces to trusted administrators or processes.