Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is } else if (len > CX82310_MTU) { which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed. With 0xffff > skb->len always true (rx_urb_size is 4096), the incomplete-packet branch saves dev->partial_len = skb->len bytes into dev->partial_data. partial_data is kmalloc(hard_mtu) = kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes. The next URB then reads dev->partial_len (4094) back from the same 1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack. Bail out of rx_fixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partial_len < CX82310_MTU + 2 on the save path, since every other route there has already passed the MTU check.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before d0c1ce6ef4cefe568e19afa83f543caa3c3c0873; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 0dbc89e664b4609ad672b5bdeef60df251294b8f; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 00520cdd21ea6a9b5dc8d53bbd241620d2059554; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 59bf9e94bdc49557f07d87164269daff7340f4d6; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 659654654eb140851467af41d610473c100c7975; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 237c9ae7145772af147e4665f158938350fa5658; affected ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 5d50e90add8b4a978395e893e81954d19d58a7c5; affected 5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb; affected c1b187a86a176e42f5e48066556980e3232b6cab; affected 4.19.322 before 4.20; affected 5.4.284 before 5.5 |
| Linux / Linux | affected 5.10; unaffected 0 before 5.10; unaffected 5.10.271 through 5.10.*; unaffected 5.15.222 through 5.15.*; unaffected 6.1.189 through 6.1.*; unaffected 6.6.158 through 6.6.*; unaffected 6.12.111 through 6.12.*; unaffected 6.18.53 through 6.18.*; unaffected 7.2.7 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/d0c1ce6ef4cefe568e19afa83f543caa3c3c0873
- https://git.kernel.org/stable/c/0dbc89e664b4609ad672b5bdeef60df251294b8f
- https://git.kernel.org/stable/c/00520cdd21ea6a9b5dc8d53bbd241620d2059554
- https://git.kernel.org/stable/c/59bf9e94bdc49557f07d87164269daff7340f4d6
- https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287
- https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975
- https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658
- https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5