cve-2024-56717
Vulnerability from cvelistv5
Published
2024-12-29 08:48
Modified
2025-01-20 06:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic() Packets injected by the CPU should have a SRC_PORT field equal to the CPU port module index in the Analyzer block (ocelot->num_phys_ports). The blamed commit copied the ocelot_ifh_set_basic() call incorrectly from ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling with "x", it calls with BIT_ULL(x), but the field is not a port mask, but rather a single port index. [ side note: this is the technical debt of code duplication :( ] The error used to be silent and doesn't appear to have other user-visible manifestations, but with new changes in the packing library, it now fails loudly as follows: ------------[ cut here ]------------ Cannot store 0x40 inside bits 46-43 - will truncate sja1105 spi2.0: xmit timed out WARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198 sja1105 spi2.0: timed out polling for tstamp CPU: 1 UID: 0 PID: 102 Comm: felix_xmit Tainted: G W N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605 Call trace: __pack+0x90/0x198 (P) __pack+0x90/0x198 (L) packing+0x78/0x98 ocelot_ifh_set_basic+0x260/0x368 ocelot_port_inject_frame+0xa8/0x250 felix_port_deferred_xmit+0x14c/0x258 kthread_worker_fn+0x134/0x350 kthread+0x114/0x138 The code path pertains to the ocelot switchdev driver and to the felix secondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q. The messenger (packing) is not really to blame, so fix the original commit instead.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2d5df3a680ffdaf606baa10636bdb1daf757832ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2f3c62ffe88116cd2a39cd73e01103535599970fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/59c4ca8d8d7918eb6e2df91d2c254827264be309Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a8836eae3288c351acd3b2743d2fad2a4ee2bd56Patch
Impacted products
Vendor Product Version
Linux Linux Version: 06bcb9032e05ad717f9fd0a6e2fd3ae7f430fa31
Version: ff7f554bbd75d5cbf00cded81d05147c6617e876
Version: e1b9e80236c540fa85d76e2d510d1b38e1968c5d
Version: e1b9e80236c540fa85d76e2d510d1b38e1968c5d
 Create a notification for this product.
   Linux Linux Version: 6.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/net/ethernet/mscc/ocelot.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "59c4ca8d8d7918eb6e2df91d2c254827264be309",
                     status: "affected",
                     version: "06bcb9032e05ad717f9fd0a6e2fd3ae7f430fa31",
                     versionType: "git",
                  },
                  {
                     lessThan: "2f3c62ffe88116cd2a39cd73e01103535599970f",
                     status: "affected",
                     version: "ff7f554bbd75d5cbf00cded81d05147c6617e876",
                     versionType: "git",
                  },
                  {
                     lessThan: "a8836eae3288c351acd3b2743d2fad2a4ee2bd56",
                     status: "affected",
                     version: "e1b9e80236c540fa85d76e2d510d1b38e1968c5d",
                     versionType: "git",
                  },
                  {
                     lessThan: "2d5df3a680ffdaf606baa10636bdb1daf757832e",
                     status: "affected",
                     version: "e1b9e80236c540fa85d76e2d510d1b38e1968c5d",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/net/ethernet/mscc/ocelot.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.11",
                  },
                  {
                     lessThan: "6.11",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.122",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.68",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.12.*",
                     status: "unaffected",
                     version: "6.12.7",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.13",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()\n\nPackets injected by the CPU should have a SRC_PORT field equal to the\nCPU port module index in the Analyzer block (ocelot->num_phys_ports).\n\nThe blamed commit copied the ocelot_ifh_set_basic() call incorrectly\nfrom ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling\nwith \"x\", it calls with BIT_ULL(x), but the field is not a port mask,\nbut rather a single port index.\n\n[ side note: this is the technical debt of code duplication :( ]\n\nThe error used to be silent and doesn't appear to have other\nuser-visible manifestations, but with new changes in the packing\nlibrary, it now fails loudly as follows:\n\n------------[ cut here ]------------\nCannot store 0x40 inside bits 46-43 - will truncate\nsja1105 spi2.0: xmit timed out\nWARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198\nsja1105 spi2.0: timed out polling for tstamp\nCPU: 1 UID: 0 PID: 102 Comm: felix_xmit\nTainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605\nCall trace:\n __pack+0x90/0x198 (P)\n __pack+0x90/0x198 (L)\n packing+0x78/0x98\n ocelot_ifh_set_basic+0x260/0x368\n ocelot_port_inject_frame+0xa8/0x250\n felix_port_deferred_xmit+0x14c/0x258\n kthread_worker_fn+0x134/0x350\n kthread+0x114/0x138\n\nThe code path pertains to the ocelot switchdev driver and to the felix\nsecondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.\n\nThe messenger (packing) is not really to blame, so fix the original\ncommit instead.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-20T06:26:47.690Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/59c4ca8d8d7918eb6e2df91d2c254827264be309",
            },
            {
               url: "https://git.kernel.org/stable/c/2f3c62ffe88116cd2a39cd73e01103535599970f",
            },
            {
               url: "https://git.kernel.org/stable/c/a8836eae3288c351acd3b2743d2fad2a4ee2bd56",
            },
            {
               url: "https://git.kernel.org/stable/c/2d5df3a680ffdaf606baa10636bdb1daf757832e",
            },
         ],
         title: "net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-56717",
      datePublished: "2024-12-29T08:48:49.958Z",
      dateReserved: "2024-12-27T15:00:39.858Z",
      dateUpdated: "2025-01-20T06:26:47.690Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-56717\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-29T09:15:06.907\",\"lastModified\":\"2025-01-10T17:36:02.260\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()\\n\\nPackets injected by the CPU should have a SRC_PORT field equal to the\\nCPU port module index in the Analyzer block (ocelot->num_phys_ports).\\n\\nThe blamed commit copied the ocelot_ifh_set_basic() call incorrectly\\nfrom ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling\\nwith \\\"x\\\", it calls with BIT_ULL(x), but the field is not a port mask,\\nbut rather a single port index.\\n\\n[ side note: this is the technical debt of code duplication :( ]\\n\\nThe error used to be silent and doesn't appear to have other\\nuser-visible manifestations, but with new changes in the packing\\nlibrary, it now fails loudly as follows:\\n\\n------------[ cut here ]------------\\nCannot store 0x40 inside bits 46-43 - will truncate\\nsja1105 spi2.0: xmit timed out\\nWARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198\\nsja1105 spi2.0: timed out polling for tstamp\\nCPU: 1 UID: 0 PID: 102 Comm: felix_xmit\\nTainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605\\nCall trace:\\n __pack+0x90/0x198 (P)\\n __pack+0x90/0x198 (L)\\n packing+0x78/0x98\\n ocelot_ifh_set_basic+0x260/0x368\\n ocelot_port_inject_frame+0xa8/0x250\\n felix_port_deferred_xmit+0x14c/0x258\\n kthread_worker_fn+0x134/0x350\\n kthread+0x114/0x138\\n\\nThe code path pertains to the ocelot switchdev driver and to the felix\\nsecondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.\\n\\nThe messenger (packing) is not really to blame, so fix the original\\ncommit instead.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mscc: ocelot: se corrige el campo IFH SRC_PORT incorrecto en ocelot_ifh_set_basic() Los paquetes inyectados por la CPU deben tener un campo SRC_PORT igual al índice del módulo de puerto de la CPU en el bloque Analyzer (ocelot->num_phys_ports). el commit culpable copió la llamada ocelot_ifh_set_basic() incorrectamente desde ocelot_xmit_common() en net/dsa/tag_ocelot.c. En lugar de llamar con \\\"x\\\", llama con BIT_ULL(x), pero el campo no es una máscara de puerto, sino un índice de puerto único. [ nota al margen: esta es la deuda técnica de la duplicación de código :( ] El error solía ser silencioso y no parece tener otras manifestaciones visibles para el usuario, pero con los nuevos cambios en la librería de empaquetado, ahora falla ruidosamente de la siguiente manera: ------------[ cortar aquí ]------------ No se puede almacenar 0x40 dentro de los bits 46-43 - truncará sja1105 spi2.0: xmit timed out WARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198 sja1105 spi2.0: timed out polling for tstamp CPU: 1 UID: 0 PID: 102 Comm: felix_xmit Tainted: GWN 6.13.0-rc1-00372-gf706b85d972d-dirty #2605 Rastreo de llamadas: __pack+0x90/0x198 (P) __pack+0x90/0x198 (L) packing+0x78/0x98 ocelot_ifh_set_basic+0x260/0x368 ocelot_port_inject_frame+0xa8/0x250 felix_port_deferred_xmit+0x14c/0x258 kthread_worker_fn+0x134/0x350 kthread+0x114/0x138 La ruta del código pertenece al controlador switchdev de ocelot y al protocolo de etiqueta DSA secundaria de felix, ocelot-8021q. Aquí se ve con ocelot-8021q. El mensajero (packing) no es realmente el culpable, así que arregle el commit original en su lugar.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.107\",\"versionEndExcluding\":\"6.1.122\",\"matchCriteriaId\":\"66B11D95-C9D9-4D15-B338-C26B1B4C6941\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.48\",\"versionEndExcluding\":\"6.6.68\",\"matchCriteriaId\":\"BA7165E0-1A7F-4895-911D-F511CD3EEFBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.7\",\"versionEndExcluding\":\"6.12.7\",\"matchCriteriaId\":\"756D1E80-26A8-439B-9124-504429A0207E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d5df3a680ffdaf606baa10636bdb1daf757832e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f3c62ffe88116cd2a39cd73e01103535599970f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59c4ca8d8d7918eb6e2df91d2c254827264be309\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8836eae3288c351acd3b2743d2fad2a4ee2bd56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.