Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
In the Linux kernel, the following vulnerability has been resolved:net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAPIf one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided,taprio_parse_mqprio_opt() must validate it, or userspacecan inject arbitrary data to the kernel, the second timetaprio_change() is called.First call (with valid attributes) sets dev->num_tcto a non zero value.Second call (with arbitrary mqprio attributes)returns early from taprio_parse_mqprio_opt()and bad things can happen.
No PoCs from references.
- https://github.com/xairy/linux-kernel-exploitation