Action not permitted
Modal body text goes here.
Modal Title
Modal Body
gsd-2024-27405
Vulnerability from gsd
Modified
2024-02-26 06:02
Details
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Aliases
{ gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2024-27405", ], id: "GSD-2024-27405", modified: "2024-02-26T06:02:26.826740Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2024-27405", STATE: "RESERVED", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.", }, ], }, }, }, }
cve-2024-27405
Vulnerability from cvelistv5
Published
2024-05-17 11:40
Modified
2025-01-28 16:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
It is observed sometimes when tethering is used over NCM with Windows 11
as host, at some instances, the gadget_giveback has one byte appended at
the end of a proper NTB. When the NTB is parsed, unwrap call looks for
any leftover bytes in SKB provided by u_ether and if there are any pending
bytes, it treats them as a separate NTB and parses it. But in case the
second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that
were parsed properly in the first NTB and saved in rx_list are dropped.
Adding a few custom traces showed the following:
[002] d..1 7828.532866: dwc3_gadget_giveback: ep1out:
req 000000003868811a length 1025/16384 zsI ==> 0
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400
[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10
[002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames
In this case, the giveback is of 1025 bytes and block length is 1024.
The rest 1 byte (which is 0x00) won't be parsed resulting in drop of
all datagrams in rx_list.
Same is case with packets of size 2048:
[002] d..1 7828.557948: dwc3_gadget_giveback: ep1out:
req 0000000011dfd96e length 2049/16384 zsI ==> 0
[002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800
Lecroy shows one byte coming in extra confirming that the byte is coming
in from PC:
Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590)
- Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)
--- Packet 4063861
Data(1024 bytes)
Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)
--- Packet 4063863
Data(1 byte)
Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)
According to Windows driver, no ZLP is needed if wBlockLength is non-zero,
because the non-zero wBlockLength has already told the function side the
size of transfer to be expected. However, there are in-market NCM devices
that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.
To deal with such devices, it pads an extra 0 at end so the transfer is no
longer multiple of wMaxPacketSize.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c Version: 9f6ce4240a2bf456402c15c06768059e5973f28c |
||||||
|
|||||||||
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "affected", version: "9f6ce4240a2b", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "affected", version: "2.6.38", }, ], }, { cpes: [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "0", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "4.19.308", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "5.4.270", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "5.10.211", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "5.15.150", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "6.1.80", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "6.6.19", }, ], }, { cpes: [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "6.7.7", }, ], }, { cpes: [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "linux_kernel", vendor: "linux", versions: [ { status: "unaffected", version: "6.8", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-27405", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-28T16:38:04.984999Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "CWE-476 NULL Pointer Dereference", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-28T16:38:24.854Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T00:34:52.278Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/059285e04ebb273d32323fbad5431c5b94f77e48", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/a31cf46d108dabce3df80b3e5c07661e24912151", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/2cb66b62a5d64ccf09b0591ab86fb085fa491fc5", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/35b604a37ec70d68b19dafd10bbacf1db505c9ca", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/2b7ec68869d50ea998908af43b643bca7e54577e", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/c7f43900bc723203d7554d299a2ce844054fab8e", }, { tags: [ "x_transferred", ], url: "https://git.kernel.org/stable/c/76c51146820c5dac629f21deafab0a7039bc3ccd", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Linux", programFiles: [ "drivers/usb/gadget/function/f_ncm.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { lessThan: "059285e04ebb273d32323fbad5431c5b94f77e48", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "a31cf46d108dabce3df80b3e5c07661e24912151", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "57ca0e16f393bb21d69734e536e383a3a4c665fd", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "2cb66b62a5d64ccf09b0591ab86fb085fa491fc5", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "35b604a37ec70d68b19dafd10bbacf1db505c9ca", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "2b7ec68869d50ea998908af43b643bca7e54577e", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "c7f43900bc723203d7554d299a2ce844054fab8e", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, { lessThan: "76c51146820c5dac629f21deafab0a7039bc3ccd", status: "affected", version: "9f6ce4240a2bf456402c15c06768059e5973f28c", versionType: "git", }, ], }, { defaultStatus: "affected", product: "Linux", programFiles: [ "drivers/usb/gadget/function/f_ncm.c", ], repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", vendor: "Linux", versions: [ { status: "affected", version: "2.6.38", }, { lessThan: "2.6.38", status: "unaffected", version: "0", versionType: "semver", }, { lessThanOrEqual: "4.19.*", status: "unaffected", version: "4.19.308", versionType: "semver", }, { lessThanOrEqual: "5.4.*", status: "unaffected", version: "5.4.270", versionType: "semver", }, { lessThanOrEqual: "5.10.*", status: "unaffected", version: "5.10.211", versionType: "semver", }, { lessThanOrEqual: "5.15.*", status: "unaffected", version: "5.15.150", versionType: "semver", }, { lessThanOrEqual: "6.1.*", status: "unaffected", version: "6.1.80", versionType: "semver", }, { lessThanOrEqual: "6.6.*", status: "unaffected", version: "6.6.19", versionType: "semver", }, { lessThanOrEqual: "6.7.*", status: "unaffected", version: "6.7.7", versionType: "semver", }, { lessThanOrEqual: "*", status: "unaffected", version: "6.8", versionType: "original_commit_for_fix", }, ], }, ], descriptions: [ { lang: "en", value: "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs\n\nIt is observed sometimes when tethering is used over NCM with Windows 11\nas host, at some instances, the gadget_giveback has one byte appended at\nthe end of a proper NTB. When the NTB is parsed, unwrap call looks for\nany leftover bytes in SKB provided by u_ether and if there are any pending\nbytes, it treats them as a separate NTB and parses it. But in case the\nsecond NTB (as per unwrap call) is faulty/corrupt, all the datagrams that\nwere parsed properly in the first NTB and saved in rx_list are dropped.\n\nAdding a few custom traces showed the following:\n[002] d..1 7828.532866: dwc3_gadget_giveback: ep1out:\nreq 000000003868811a length 1025/16384 zsI ==> 0\n[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025\n[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342\n[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67\n[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400\n[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10\n[002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames\n\nIn this case, the giveback is of 1025 bytes and block length is 1024.\nThe rest 1 byte (which is 0x00) won't be parsed resulting in drop of\nall datagrams in rx_list.\n\nSame is case with packets of size 2048:\n[002] d..1 7828.557948: dwc3_gadget_giveback: ep1out:\nreq 0000000011dfd96e length 2049/16384 zsI ==> 0\n[002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342\n[002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800\n\nLecroy shows one byte coming in extra confirming that the byte is coming\nin from PC:\n\n Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590)\n - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)\n --- Packet 4063861\n Data(1024 bytes)\n Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)\n --- Packet 4063863\n Data(1 byte)\n Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)\n\nAccording to Windows driver, no ZLP is needed if wBlockLength is non-zero,\nbecause the non-zero wBlockLength has already told the function side the\nsize of transfer to be expected. However, there are in-market NCM devices\nthat rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.\nTo deal with such devices, it pads an extra 0 at end so the transfer is no\nlonger multiple of wMaxPacketSize.", }, ], providerMetadata: { dateUpdated: "2024-12-19T08:54:24.148Z", orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", shortName: "Linux", }, references: [ { url: "https://git.kernel.org/stable/c/059285e04ebb273d32323fbad5431c5b94f77e48", }, { url: "https://git.kernel.org/stable/c/a31cf46d108dabce3df80b3e5c07661e24912151", }, { url: "https://git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd", }, { url: "https://git.kernel.org/stable/c/2cb66b62a5d64ccf09b0591ab86fb085fa491fc5", }, { url: "https://git.kernel.org/stable/c/35b604a37ec70d68b19dafd10bbacf1db505c9ca", }, { url: "https://git.kernel.org/stable/c/2b7ec68869d50ea998908af43b643bca7e54577e", }, { url: "https://git.kernel.org/stable/c/c7f43900bc723203d7554d299a2ce844054fab8e", }, { url: "https://git.kernel.org/stable/c/76c51146820c5dac629f21deafab0a7039bc3ccd", }, ], title: "usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs", x_generator: { engine: "bippy-5f407fcff5a0", }, }, }, cveMetadata: { assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67", assignerShortName: "Linux", cveId: "CVE-2024-27405", datePublished: "2024-05-17T11:40:25.069Z", dateReserved: "2024-02-25T13:47:42.681Z", dateUpdated: "2025-01-28T16:38:24.854Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.