CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-27405 – usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
https://notcve.org/view.php?id=CVE-2024-27405
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped. Adding a few custom traces showed the following: [002] d..1 7828.532866: dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI ==> 0 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list. Same is case with packets of size 2048: [002] d..1 7828.557948: dwc3_gadget_giveback: ep1out: req 0000000011dfd96e length 2049/16384 zsI ==> 0 [002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800 Lecroy shows one byte coming in extra confirming that the byte is coming in from PC: Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590) - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590) --- Packet 4063861 Data(1024 bytes) Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590) --- Packet 4063863 Data(1 byte) Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722) According to Windows driver, no ZLP is needed if wBlockLength is non-zero, because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there are in-market NCM devices that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the transfer is no longer multiple of wMaxPacketSize. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: ncm: Evite soltar datagramas de NTB analizados correctamente. • https://git.kernel.org/stable/c/9f6ce4240a2bf456402c15c06768059e5973f28c https://git.kernel.org/stable/c/059285e04ebb273d32323fbad5431c5b94f77e48 https://git.kernel.org/stable/c/a31cf46d108dabce3df80b3e5c07661e24912151 https://git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd https://git.kernel.org/stable/c/2cb66b62a5d64ccf09b0591ab86fb085fa491fc5 https://git.kernel.org/stable/c/35b604a37ec70d68b19dafd10bbacf1db505c9ca https://git.kernel.org/stable/c/2b7ec68869d50ea998908af43b643bca7e54577e https://git.kernel.org/stable/c/c7f43900bc723203d7554d299a2ce8440 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-27403 – netfilter: nft_flow_offload: reset dst in route object after setting up flow
https://notcve.org/view.php?id=CVE-2024-27403
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nft_flow_offload: restablece dst en el objeto de ruta después de configurar el flujo dst se transfiere al objeto de flujo, el objeto de ruta ya no es propietario. Restablezca el dst en el objeto de ruta; de lo contrario, si flow_offload_add() fallo, la ruta de error libera el dst dos veces, lo que provoca un desbordamiento insuficiente del recuento. • https://git.kernel.org/stable/c/a3c90f7a2323b331ae816d5b0633e68148e25d04 https://git.kernel.org/stable/c/4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c https://git.kernel.org/stable/c/012df10717da02367aaf92c65f9c89db206c15f4 https://git.kernel.org/stable/c/558b00a30e05753a62ecc7e05e939ca8f0241148 https://git.kernel.org/stable/c/670548c8db44d76e40e1dfc06812bca36a61e9ae https://git.kernel.org/stable/c/9e0f0430389be7696396c62f037be4bf72cf93e3 https://access.redhat.com/security/cve/CVE-2024-27403 https://bugzilla.redhat.com/show_bug.cgi?id=2281127 •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-27402 – phonet/pep: fix racy skb_queue_empty() use
https://notcve.org/view.php?id=CVE-2024-27402
In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skb_queue_empty() use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skb_peek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: phonet/pep: corrige el uso picante de skb_queue_empty() Las colas de recepción están protegidas por sus respectivos spin-lock, no por el socket lock. Esto podría provocar que skb_peek() devuelva inesperadamente NULL o un puntero a un búfer de socket ya retirado de la cola. • https://git.kernel.org/stable/c/9641458d3ec42def729fde64669abf07f3220cd5 https://git.kernel.org/stable/c/9d5523e065b568e79dfaa2ea1085a5bcf74baf78 https://git.kernel.org/stable/c/0a9f558c72c47472c38c05fcb72c70abb9104277 https://git.kernel.org/stable/c/8ef4fcc7014b9f93619851d6b78d6cc2789a4c88 https://git.kernel.org/stable/c/7d2a894d7f487dcb894df023e9d3014cf5b93fe5 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52656 – io_uring: drop any code related to SCM_RIGHTS
https://notcve.org/view.php?id=CVE-2023-52656
In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring: elimina cualquier código relacionado con SCM_RIGHTS. Este es un código inactivo después de que dejamos de admitir el paso de io_uring fds sobre SCM_RIGHTS, deshazte de él. A flaw was found in the Linux kernel that addresses the removal of dead code related to `SCM_RIGHTS` support within the `io_uring`. This code was deemed unnecessary after the kernel dropped the ability to pass `io_uring` file descriptors over `SCM_RIGHTS`. • https://git.kernel.org/stable/c/cfb24022bb2c31f1f555dc6bc3cc5e2547446fb3 https://git.kernel.org/stable/c/a6771f343af90a25f3a14911634562bb5621df02 https://git.kernel.org/stable/c/d909d381c3152393421403be4b6435f17a2378b4 https://git.kernel.org/stable/c/a3812a47a32022ca76bf46ddacdd823dc2aabf8b https://git.kernel.org/stable/c/88c49d9c896143cdc0f77197c4dcf24140375e89 https://git.kernel.org/stable/c/6e5e6d274956305f1fc0340522b38f5f5be74bdb https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html https://access.redhat.com/security/cve/CVE-2023 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-27401 – firewire: nosy: ensure user_length is taken into account when fetching packet contents
https://notcve.org/view.php?id=CVE-2024-27401
In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firewire: nosy: asegúrese de que se tenga en cuenta la longitud de usuario al recuperar el contenido del paquete. Asegúrese de que paquete_buffer_get respete la longitud de usuario proporcionada. • https://git.kernel.org/stable/c/67f34f093c0f7bf33f5b4ae64d3d695a3b978285 https://git.kernel.org/stable/c/7b8c7bd2296e95b38a6ff346242356a2e7190239 https://git.kernel.org/stable/c/cca330c59c54207567a648357835f59df9a286bb https://git.kernel.org/stable/c/79f988d3ffc1aa778fc5181bdfab312e57956c6b https://git.kernel.org/stable/c/4ee0941da10e8fdcdb34756b877efd3282594c1f https://git.kernel.org/stable/c/1fe60ee709436550f8cfbab01295936b868d5baa https://git.kernel.org/stable/c/539d51ac48bcfcfa1b3d4a85f8df92fa22c1d41c https://git.kernel.org/stable/c/38762a0763c10c24a4915feee722d7aa6 •