CVE-2024-36244

What it actually does

The taprio scheduler in the Linux kernel net/sched subsystem permits a user-supplied cycle-time shorter than the sum of entry intervals and below the minimum required (N * ETH_ZLEN bit times), bypassing earlier length checks and allowing invalid schedule configurations that can trigger kernel-side arithmetic or resource issues.

Why it matters to the business

Systems relying on time-aware traffic shaping may experience kernel instability or crashes when unprivileged or compromised processes supply malformed schedules, leading to network downtime on servers, routers, or embedded devices that use the feature.

How an attack unfolds

An attacker with sufficient privileges to configure network schedulers crafts a taprio netlink request containing a cycle time that evades the per-entry minimum while remaining below the aggregate threshold; the kernel accepts the schedule, stores the invalid state, and later performs operations that can cause out-of-bounds access or resource misuse during packet transmission.

How to fix it

Upgrade the Linux kernel to commit bbf5c979011a099af5dc76498918ed7df445635b or later; rebuild and reboot with the patched kernel; where immediate patching is impossible, restrict use of taprio qdiscs to trusted administrative contexts only.

How to confirm the fix worked

Confirm the running kernel contains commit bbf5c979011a099af5dc76498918ed7df445635b; attempt to install a taprio schedule whose cycle-time violates the new aggregate minimum and verify the kernel rejects the request with an appropriate error; review kernel selftests for taprio to ensure the added test case passes.

Typical attack path

1. Obtain CAP_NET_ADMIN or equivalent privileges on the target host
2. Open a netlink socket to the rtnetlink interface
3. Construct a TC_H_ classid and taprio Qdisc configuration with a cycle-time shorter than N * ETH_ZLEN bit times
4. Submit the malformed schedule via RTM_NEWQDISC
5. Trigger traffic through the affected interface to exercise the schedule

How to detect it

Review kernel logs for taprio-related warnings or oops messages around net/sched; inspect audit logs for unusual RTM_NEWQDISC or TC netlink activity from non-root processes; correlate with process execution of tools that manipulate traffic control (tc).

What your security team should do

• Prioritize kernel updates on all systems exposing taprio or other advanced qdiscs to external or multi-tenant workloads
• Audit existing network configurations for any taprio usage and document required cycle-time constraints
• Apply least-privilege controls around network namespace and qdisc configuration capabilities
• Monitor upstream stable branches for backports of the referenced fix