| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-38567: wifi: carl9170: add a proper sanity check for endpoints |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| wifi: carl9170: add a proper sanity check for endpoints |
| |
| Syzkaller reports [1] hitting a warning which is caused by presence |
| of a wrong endpoint type at the URB sumbitting stage. While there |
| was a check for a specific 4th endpoint, since it can switch types |
| between bulk and interrupt, other endpoints are trusted implicitly. |
| Similar warning is triggered in a couple of other syzbot issues [2]. |
| |
| Fix the issue by doing a comprehensive check of all endpoints |
| taking into account difference between high- and full-speed |
| configuration. |
| |
| [1] Syzkaller report: |
| ... |
| WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 |
| ... |
| Call Trace: |
| <TASK> |
| carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 |
| carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] |
| carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] |
| carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 |
| request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 |
| process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 |
| worker_thread+0x669/0x1090 kernel/workqueue.c:2436 |
| kthread+0x2e8/0x3a0 kernel/kthread.c:376 |
| ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 |
| </TASK> |
| |
| [2] Related syzkaller crashes: |
| |
| The Linux kernel CVE team has assigned CVE-2024-38567 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 4.19.316 with commit eb0f2fc3ff5806cc572cd9055ce7c52a01e97645 |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 5.4.278 with commit ac3ed46a8741d464bc70ebdf7433c1d786cf329d |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 5.10.219 with commit 8650725bb0a48b206d5a8ddad3a7488f9a5985b7 |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 5.15.161 with commit 6a9892bf24c906b4d6b587f8759ca38bff672582 |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 6.1.93 with commit 265c3cda471c26e0f25d0c755da94e1eb15d7a0c |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 6.6.33 with commit 62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 6.8.12 with commit 03ddc74bdfd71b84a55c9f2185d8787f258422cd |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 6.9.3 with commit 0fa08a55201ab9be72bacb8ea93cf752d338184f |
| Issue introduced in 2.6.37 with commit a84fab3cbfdc427e7d366f1cc844f27b2084c26c and fixed in 6.10 with commit b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-38567 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/wireless/ath/carl9170/usb.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/eb0f2fc3ff5806cc572cd9055ce7c52a01e97645 |
| https://git.kernel.org/stable/c/ac3ed46a8741d464bc70ebdf7433c1d786cf329d |
| https://git.kernel.org/stable/c/8650725bb0a48b206d5a8ddad3a7488f9a5985b7 |
| https://git.kernel.org/stable/c/6a9892bf24c906b4d6b587f8759ca38bff672582 |
| https://git.kernel.org/stable/c/265c3cda471c26e0f25d0c755da94e1eb15d7a0c |
| https://git.kernel.org/stable/c/62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd |
| https://git.kernel.org/stable/c/03ddc74bdfd71b84a55c9f2185d8787f258422cd |
| https://git.kernel.org/stable/c/0fa08a55201ab9be72bacb8ea93cf752d338184f |
| https://git.kernel.org/stable/c/b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0 |
