CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
13.0%
In the Linux kernel, the following vulnerability has been resolved: usb:
gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is
observed sometimes when tethering is used over NCM with Windows 11 as host,
at some instances, the gadget_giveback has one byte appended at the end of
a proper NTB. When the NTB is parsed, unwrap call looks for any leftover
bytes in SKB provided by u_ether and if there are any pending bytes, it
treats them as a separate NTB and parses it. But in case the second NTB (as
per unwrap call) is faulty/corrupt, all the datagrams that were parsed
properly in the first NTB and saved in rx_list are dropped. Adding a few
custom traces showed the following: [002] d…1 7828.532866:
dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI
==> 0 [002] d…1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess:
1025 [002] d…1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth:
1751999342 [002] d…1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq:
0xce67 [002] d…1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len:
0x400 [002] d…1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len:
0x10 [002] d…1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In
this case, the giveback is of 1025 bytes and block length is 1024. The rest
1 byte (which is 0x00) won’t be parsed resulting in drop of all datagrams
in rx_list. Same is case with packets of size 2048: [002] d…1 7828.557948:
dwc3_gadget_giveback: ep1out: req 0000000011dfd96e length 2049/16384 zsI
==> 0 [002] d…1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth:
1751999342 [002] d…1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb
blk_len: 0x800 Lecroy shows one byte coming in extra confirming that the
byte is coming in from PC: Transfer 2959 - Bytes Transferred(1025)
Timestamp((18.524 843 590) - Transaction 8391 - Data(1025 bytes)
Timestamp(18.524 843 590) — Packet 4063861 Data(1024 bytes)
Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590) — Packet
4063863 Data(1 byte) Duration(66.160ns) Time(282.000ns) Timestamp(18.524
845 722) According to Windows driver, no ZLP is needed if wBlockLength is
non-zero, because the non-zero wBlockLength has already told the function
side the size of transfer to be expected. However, there are in-market NCM
devices that rely on ZLP as long as the wBlockLength is multiple of
wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the
transfer is no longer multiple of wMaxPacketSize.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | linux | < 5.4.0-186.206 | UNKNOWN |
ubuntu | 22.04 | noarch | linux | < 5.15.0-112.122 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws | < 5.4.0-1126.136 | UNKNOWN |
ubuntu | 22.04 | noarch | linux-aws | < 5.15.0-1063.69 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws-5.15 | < 5.15.0-1063.69~20.04.1 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-aws-5.4 | < 5.4.0-1126.136~18.04.1 | UNKNOWN |
ubuntu | 22.04 | noarch | linux-aws-6.5 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure | < 5.4.0-1131.138 | UNKNOWN |
ubuntu | 22.04 | noarch | linux-azure | < 5.15.0-1066.75 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure-5.15 | < any | UNKNOWN |
git.kernel.org/linus/76c51146820c5dac629f21deafab0a7039bc3ccd (6.8-rc6)
git.kernel.org/stable/c/059285e04ebb273d32323fbad5431c5b94f77e48
git.kernel.org/stable/c/2b7ec68869d50ea998908af43b643bca7e54577e
git.kernel.org/stable/c/2cb66b62a5d64ccf09b0591ab86fb085fa491fc5
git.kernel.org/stable/c/35b604a37ec70d68b19dafd10bbacf1db505c9ca
git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd
git.kernel.org/stable/c/76c51146820c5dac629f21deafab0a7039bc3ccd
git.kernel.org/stable/c/a31cf46d108dabce3df80b3e5c07661e24912151
git.kernel.org/stable/c/c7f43900bc723203d7554d299a2ce844054fab8e
launchpad.net/bugs/cve/CVE-2024-27405
nvd.nist.gov/vuln/detail/CVE-2024-27405
security-tracker.debian.org/tracker/CVE-2024-27405
ubuntu.com/security/notices/USN-6820-1
ubuntu.com/security/notices/USN-6820-2
ubuntu.com/security/notices/USN-6821-1
ubuntu.com/security/notices/USN-6821-2
ubuntu.com/security/notices/USN-6821-3
ubuntu.com/security/notices/USN-6821-4
ubuntu.com/security/notices/USN-6828-1
ubuntu.com/security/notices/USN-6831-1
ubuntu.com/security/notices/USN-6867-1
ubuntu.com/security/notices/USN-6871-1
ubuntu.com/security/notices/USN-6892-1
ubuntu.com/security/notices/USN-6919-1
www.cve.org/CVERecord?id=CVE-2024-27405