cve-2024-47742
Vulnerability from cvelistv5
Published
2024-10-21 12:14
Modified
2024-12-19 09:27
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain string components that are passed through from a device or semi-privileged userspace; the ones I could find (not counting interfaces that require root privileges) are: - lpfc_sli4_request_firmware_update() seems to construct the firmware filename from "ModelName", a string that was previously parsed out of some descriptor ("Vital Product Data") in lpfc_fill_vpd() - nfp_net_fw_find() seems to construct a firmware filename from a model name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I think parses some descriptor that was read from the device. (But this case likely isn't exploitable because the format string looks like "netronome/nic_%s", and there shouldn't be any *folders* starting with "netronome/nic_". The previous case was different because there, the "%s" is *at the start* of the format string.) - module_flash_fw_schedule() is reachable from the ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is enough to pass the privilege check), and takes a userspace-provided firmware name. (But I think to reach this case, you need to have CAP_NET_ADMIN over a network namespace that a special kind of ethernet device is mapped into, so I think this is not a viable attack path in practice.) Fix it by rejecting any firmware names containing ".." path components. For what it's worth, I went looking and haven't found any USB device drivers that use the firmware loader dangerously.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebebPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ecPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394Patch
Impacted products
Vendor Product Version
Linux Linux Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
 Create a notification for this product.
   Linux Linux Version: 3.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-47742",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-21T12:59:04.060717Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-21T13:04:14.368Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/base/firmware_loader/main.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "d1768e5535d3ded59f888637016e6f821f4e069f",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "9b1ca33ebd05b3acef5b976c04e5e791af93ce1b",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "c30558e6c5c9ad6c86459d9acce1520ceeab9ea6",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "a77fc4acfd49fc6076e565445b2bc5fdc3244da4",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "3d2411f4edcb649eaf232160db459bb4770b5251",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "7420c1bf7fc784e587b87329cc6dfa3dca537aa4",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "6c4e13fdfcab34811c3143a0a03c05fec4e870ec",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
                  {
                     lessThan: "f0e5311aa8022107d63c54e2f03684ec097d1394",
                     status: "affected",
                     version: "abb139e75c2cdbb955e840d6331cb5863e409d0e",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/base/firmware_loader/main.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "3.7",
                  },
                  {
                     lessThan: "3.7",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "4.19.*",
                     status: "unaffected",
                     version: "4.19.323",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.4.*",
                     status: "unaffected",
                     version: "5.4.285",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.227",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.168",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.113",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.54",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.10.*",
                     status: "unaffected",
                     version: "6.10.13",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.11.*",
                     status: "unaffected",
                     version: "6.11.2",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.12",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Block path traversal\n\nMost firmware names are hardcoded strings, or are constructed from fairly\nconstrained format strings where the dynamic parts are just some hex\nnumbers or such.\n\nHowever, there are a couple codepaths in the kernel where firmware file\nnames contain string components that are passed through from a device or\nsemi-privileged userspace; the ones I could find (not counting interfaces\nthat require root privileges) are:\n\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\n   filename from \"ModelName\", a string that was previously parsed out of\n   some descriptor (\"Vital Product Data\") in lpfc_fill_vpd()\n - nfp_net_fw_find() seems to construct a firmware filename from a model\n   name coming from nfp_hwinfo_lookup(pf->hwinfo, \"nffw.partno\"), which I\n   think parses some descriptor that was read from the device.\n   (But this case likely isn't exploitable because the format string looks\n   like \"netronome/nic_%s\", and there shouldn't be any *folders* starting\n   with \"netronome/nic_\". The previous case was different because there,\n   the \"%s\" is *at the start* of the format string.)\n - module_flash_fw_schedule() is reachable from the\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\n   enough to pass the privilege check), and takes a userspace-provided\n   firmware name.\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\n   network namespace that a special kind of ethernet device is mapped into,\n   so I think this is not a viable attack path in practice.)\n\nFix it by rejecting any firmware names containing \"..\" path components.\n\nFor what it's worth, I went looking and haven't found any USB device\ndrivers that use the firmware loader dangerously.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:27:12.659Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f",
            },
            {
               url: "https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b",
            },
            {
               url: "https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6",
            },
            {
               url: "https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4",
            },
            {
               url: "https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251",
            },
            {
               url: "https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4",
            },
            {
               url: "https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb",
            },
            {
               url: "https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec",
            },
            {
               url: "https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394",
            },
         ],
         title: "firmware_loader: Block path traversal",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-47742",
      datePublished: "2024-10-21T12:14:10.499Z",
      dateReserved: "2024-09-30T16:00:12.959Z",
      dateUpdated: "2024-12-19T09:27:12.659Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-47742\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:04.297\",\"lastModified\":\"2024-11-08T16:15:27.613\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware_loader: Block path traversal\\n\\nMost firmware names are hardcoded strings, or are constructed from fairly\\nconstrained format strings where the dynamic parts are just some hex\\nnumbers or such.\\n\\nHowever, there are a couple codepaths in the kernel where firmware file\\nnames contain string components that are passed through from a device or\\nsemi-privileged userspace; the ones I could find (not counting interfaces\\nthat require root privileges) are:\\n\\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\\n   filename from \\\"ModelName\\\", a string that was previously parsed out of\\n   some descriptor (\\\"Vital Product Data\\\") in lpfc_fill_vpd()\\n - nfp_net_fw_find() seems to construct a firmware filename from a model\\n   name coming from nfp_hwinfo_lookup(pf->hwinfo, \\\"nffw.partno\\\"), which I\\n   think parses some descriptor that was read from the device.\\n   (But this case likely isn't exploitable because the format string looks\\n   like \\\"netronome/nic_%s\\\", and there shouldn't be any *folders* starting\\n   with \\\"netronome/nic_\\\". The previous case was different because there,\\n   the \\\"%s\\\" is *at the start* of the format string.)\\n - module_flash_fw_schedule() is reachable from the\\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\\n   enough to pass the privilege check), and takes a userspace-provided\\n   firmware name.\\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\\n   network namespace that a special kind of ethernet device is mapped into,\\n   so I think this is not a viable attack path in practice.)\\n\\nFix it by rejecting any firmware names containing \\\"..\\\" path components.\\n\\nFor what it's worth, I went looking and haven't found any USB device\\ndrivers that use the firmware loader dangerously.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware_loader: Block path traversal La mayoría de los nombres de firmware son cadenas codificadas o se construyen a partir de cadenas de formato bastante restringidas donde las partes dinámicas son solo algunos números hexadecimales o algo así. Sin embargo, hay un par de rutas de código en el kernel donde los nombres de archivo de firmware contienen componentes de cadena que se pasan desde un dispositivo o un espacio de usuario semiprivilegiado; los que pude encontrar (sin contar las interfaces que requieren privilegios de root) son: - lpfc_sli4_request_firmware_update() parece construir el nombre de archivo de firmware a partir de \\\"ModelName\\\", una cadena que se analizó previamente a partir de algún descriptor (\\\"Vital Product Data\\\") en lpfc_fill_vpd() - nfp_net_fw_find() parece construir un nombre de archivo de firmware a partir de un nombre de modelo que proviene de nfp_hwinfo_lookup(pf->hwinfo, \\\"nffw.partno\\\"), que creo que analiza algún descriptor que se leyó desde el dispositivo. (Pero este caso probablemente no sea explotable porque la cadena de formato se parece a \\\"netronome/nic_%s\\\", y no debería haber ninguna *carpeta* que comience con \\\"netronome/nic_\\\". El caso anterior era diferente porque allí, el \\\"%s\\\" está *al comienzo* de la cadena de formato). - module_flash_fw_schedule() es accesible desde el comando netlink ETHTOOL_MSG_MODULE_FW_FLASH_ACT, que está marcado como GENL_UNS_ADMIN_PERM (lo que significa que CAP_NET_ADMIN dentro de un espacio de nombres de usuario es suficiente para pasar la verificación de privilegios), y toma un nombre de firmware provisto por el espacio de usuario. (Pero creo que para llegar a este caso, necesita tener CAP_NET_ADMIN sobre un espacio de nombres de red en el que se asigna un tipo especial de dispositivo Ethernet, por lo que creo que esta no es una ruta de ataque viable en la práctica). Arréglelo rechazando cualquier nombre de firmware que contenga componentes de ruta \\\"..\\\" Por si sirve de algo, he buscado y no he encontrado ningún controlador de dispositivo USB que utilice el cargador de firmware de forma peligrosa.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"3B73A13A-D7BE-4035-BEF2-2821D9D5CB6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47742\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:59:04.060717Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:59:07.169Z\"}}], \"cna\": {\"title\": \"firmware_loader: Block path traversal\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"d1768e5535d3ded59f888637016e6f821f4e069f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"a77fc4acfd49fc6076e565445b2bc5fdc3244da4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"3d2411f4edcb649eaf232160db459bb4770b5251\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"7420c1bf7fc784e587b87329cc6dfa3dca537aa4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"6c4e13fdfcab34811c3143a0a03c05fec4e870ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"f0e5311aa8022107d63c54e2f03684ec097d1394\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/base/firmware_loader/main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/base/firmware_loader/main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f\"}, {\"url\": \"https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\"}, {\"url\": \"https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\"}, {\"url\": \"https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4\"}, {\"url\": \"https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251\"}, {\"url\": \"https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4\"}, {\"url\": \"https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\"}, {\"url\": \"https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec\"}, {\"url\": \"https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware_loader: Block path traversal\\n\\nMost firmware names are hardcoded strings, or are constructed from fairly\\nconstrained format strings where the dynamic parts are just some hex\\nnumbers or such.\\n\\nHowever, there are a couple codepaths in the kernel where firmware file\\nnames contain string components that are passed through from a device or\\nsemi-privileged userspace; the ones I could find (not counting interfaces\\nthat require root privileges) are:\\n\\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\\n   filename from \\\"ModelName\\\", a string that was previously parsed out of\\n   some descriptor (\\\"Vital Product Data\\\") in lpfc_fill_vpd()\\n - nfp_net_fw_find() seems to construct a firmware filename from a model\\n   name coming from nfp_hwinfo_lookup(pf->hwinfo, \\\"nffw.partno\\\"), which I\\n   think parses some descriptor that was read from the device.\\n   (But this case likely isn't exploitable because the format string looks\\n   like \\\"netronome/nic_%s\\\", and there shouldn't be any *folders* starting\\n   with \\\"netronome/nic_\\\". The previous case was different because there,\\n   the \\\"%s\\\" is *at the start* of the format string.)\\n - module_flash_fw_schedule() is reachable from the\\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\\n   enough to pass the privilege check), and takes a userspace-provided\\n   firmware name.\\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\\n   network namespace that a special kind of ethernet device is mapped into,\\n   so I think this is not a viable attack path in practice.)\\n\\nFix it by rejecting any firmware names containing \\\"..\\\" path components.\\n\\nFor what it's worth, I went looking and haven't found any USB device\\ndrivers that use the firmware loader dangerously.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:27:12.659Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-47742\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:27:12.659Z\", \"dateReserved\": \"2024-09-30T16:00:12.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:10.499Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.