CVE-2024-26815

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check

taprio_parse_tc_entry() is not correctly checking

TCA_TAPRIO_TC_ENTRY_INDEX attribute:

int tc; // Signed value

tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]);

if (tc >= TC_QOPT_MAX_QUEUE) {

NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range");

return -ERANGE;

}

syzbot reported that it could fed arbitary negative values:

UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18

shift exponent -2147418108 is negative

CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106

ubsan_epilogue lib/ubsan.c:217 [inline]

__ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386

taprio_parse_tc_entry net

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References