THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-36016

tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

Reserved:2024-05-17
Published:2024-05-29
Updated:2024-06-12

Description

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size.

Product status

Default status
unaffected

e1eaea46bb40 before 46f52c89a7e7
affected

e1eaea46bb40 before 774d83b008ec
affected

e1eaea46bb40 before f126ce7305fe
affected

e1eaea46bb40 before b890d45aaf02
affected

e1eaea46bb40 before 47388e807f85
affected

Default status
affected

2.6.35
affected

Any version before 2.6.35
unaffected

6.1.93
unaffected

6.6.33
unaffected

6.8.12
unaffected

6.9.3
unaffected

6.10-rc1
unaffected

References

https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc

https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350

https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3

https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d

https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a

cve.org CVE-2024-36016

nvd.nist.gov CVE-2024-36016

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-36016