CVE-2024-36978

HighCVSS 7.8/10Last modified Nov 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: sch_multiq: fix possible OOB write in multiq_tune()

q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= c2999f7fb05b87da4060e38150c70fa46794d82b, < d5d9d241786f49ae7cbc08e7fc95a115e9d80f3d; >= c2999f7fb05b87da4060e38150c70fa46794d82b, < 52b1aa07cda6a199cd6754d3798c7759023bc70f; >= c2999f7fb05b87da4060e38150c70fa46794d82b, < 598572c64287aee0b75bbba4e2881496878860f3; >= c2999f7fb05b87da4060e38150c70fa46794d82b, < 0f208fad86631e005754606c3ec80c0d44a11882; >= c2999f7fb05b87da4060e38150c70fa46794d82b, < 54c2c171c11a798fe887b3ff72922aa9d1411c1e; >= c2999f7fb05b87da4060e38150c70fa46794d82b, < d6fb5110e8722bc00748f22caeb650fe4672f129; >= c2999f7fb05b87da4060e38150c70fa46794d82b, < affc18fdc694190ca7575b9a86632a73b9fe043d
LinuxLinux5.4
SiemensRUGGEDCOM RST2428P< V3.1
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family—
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 family< V3.1
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
Jun 19, 2024
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-369797.8In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspiciousCVE-2024-36988.8A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability CVE-2024-369807.5An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f7CVE-2024-369817.5An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f7CVE-2024-369827.5In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attaCVE-2024-369838.8In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authCVE-2024-369848.8In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that CVE-2024-369858.8In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles couldCVE-2024-369865.7In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authCVE-2024-369876.5In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-prCVE-2024-369894.3In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user thCVE-2024-36999.8Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is t
CVE-2024-36978: High severity, CVSS 7.8 | Vulnix