cve/published/2023/CVE-2023-52894.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2023-52894: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()

 In Google internal bug 265639009 we've received an (as yet) unreproducible
 crash report from an aarch64 GKI 5.10.149-android13 running device.

 AFAICT the source code is at:
   https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10

 The call stack is:
   ncm_close() -> ncm_notify() -> ncm_do_notify()
 with the crash at:
   ncm_do_notify+0x98/0x270
 Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)

 Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):

   // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
   0B 0D 00 79    strh w11, [x8, #6]

   // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
   6C 0A 00 B9    str  w12, [x19, #8]

   // x10 (NULL) was read here from offset 0 of valid pointer x9
   // IMHO we're reading 'cdev->gadget' and getting NULL
   // gadget is indeed at offset 0 of struct usb_composite_dev
   2A 01 40 F9    ldr  x10, [x9]

   // loading req->buf pointer, which is at offset 0 of struct usb_request
   69 02 40 F9    ldr  x9, [x19]

   // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
   4B 5D 40 B9    ldr  w11, [x10, #0x5c]

 which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:

   event->wLength = cpu_to_le16(8);
   req->length = NCM_STATUS_BYTECOUNT;

   /* SPEED_CHANGE data is up/down speeds in bits/sec */
   data = req->buf + sizeof *event;
   data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));

 My analysis of registers and NULL ptr deref crash offset
   (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)
 heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:
   data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
 which calls:
   ncm_bitrate(NULL)
 which then calls:
   gadget_is_superspeed(NULL)
 which reads
   ((struct usb_gadget *)NULL)->max_speed
 and hits a panic.

 AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.
 (remember there's a GKI KABI reservation of 16 bytes in struct work_struct)

 It's not at all clear to me how this is all supposed to work...
 but returning 0 seems much better than panic-ing...

 The Linux kernel CVE team has assigned CVE-2023-52894 to this issue.


 Affected and fixed versions
 ===========================

 	Fixed in 4.14.304 with commit fef6b29671b66dfb71f17e337c1ad14b5a2cedae
 	Fixed in 4.19.271 with commit 63d161f29cd39c050e8873aa36e0c9fc013bb763
 	Fixed in 5.4.230 with commit a21da7f7aae618c785f7e4a275d43c06dc8412b6
 	Fixed in 5.10.165 with commit e92c70059178da751e5af7de02384b7dfadb5ec7
 	Fixed in 5.15.90 with commit a69c8dfb85b44be9cc223be07d35cc3a9baefbea
 	Fixed in 6.1.8 with commit 09e4507ec8ef2d44da6ba4092b8ee2d81f216497
 	Fixed in 6.2 with commit c6ec929595c7443250b2a4faea988c62019d5cd2

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2023-52894
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/usb/gadget/function/f_ncm.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae
 	https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763
 	https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6
 	https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7
 	https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea
 	https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497
 	https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2023-52894: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()

	In Google internal bug 265639009 we've received an (as yet) unreproducible
	crash report from an aarch64 GKI 5.10.149-android13 running device.

	AFAICT the source code is at:
	https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10

	The call stack is:
	ncm_close() -> ncm_notify() -> ncm_do_notify()
	with the crash at:
	ncm_do_notify+0x98/0x270
	Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)

	Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):

	// halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
	0B 0D 00 79 strh w11, [x8, #6]

	// word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
	6C 0A 00 B9 str w12, [x19, #8]

	// x10 (NULL) was read here from offset 0 of valid pointer x9
	// IMHO we're reading 'cdev->gadget' and getting NULL
	// gadget is indeed at offset 0 of struct usb_composite_dev
	2A 01 40 F9 ldr x10, [x9]

	// loading req->buf pointer, which is at offset 0 of struct usb_request
	69 02 40 F9 ldr x9, [x19]

	// x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
	4B 5D 40 B9 ldr w11, [x10, #0x5c]

	which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:

	event->wLength = cpu_to_le16(8);
	req->length = NCM_STATUS_BYTECOUNT;

	/* SPEED_CHANGE data is up/down speeds in bits/sec */
	data = req->buf + sizeof *event;
	data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));

	My analysis of registers and NULL ptr deref crash offset
	(Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)
	heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:
	data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
	which calls:
	ncm_bitrate(NULL)
	which then calls:
	gadget_is_superspeed(NULL)
	which reads
	((struct usb_gadget *)NULL)->max_speed
	and hits a panic.

	AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.
	(remember there's a GKI KABI reservation of 16 bytes in struct work_struct)

	It's not at all clear to me how this is all supposed to work...
	but returning 0 seems much better than panic-ing...

	The Linux kernel CVE team has assigned CVE-2023-52894 to this issue.


	Affected and fixed versions
	===========================

	Fixed in 4.14.304 with commit fef6b29671b66dfb71f17e337c1ad14b5a2cedae
	Fixed in 4.19.271 with commit 63d161f29cd39c050e8873aa36e0c9fc013bb763
	Fixed in 5.4.230 with commit a21da7f7aae618c785f7e4a275d43c06dc8412b6
	Fixed in 5.10.165 with commit e92c70059178da751e5af7de02384b7dfadb5ec7
	Fixed in 5.15.90 with commit a69c8dfb85b44be9cc223be07d35cc3a9baefbea
	Fixed in 6.1.8 with commit 09e4507ec8ef2d44da6ba4092b8ee2d81f216497
	Fixed in 6.2 with commit c6ec929595c7443250b2a4faea988c62019d5cd2

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52894
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/usb/gadget/function/f_ncm.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae
	https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763
	https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6
	https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7
	https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea
	https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497
	https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2