From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A61C316C85D for ; Wed, 21 Aug 2024 06:12:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724220769; cv=none; b=USr3/TYU+vxgFEdmX4bRDLV0d6SOPC22PmW1OzF/X5rnVycGxEt1S/1yEmeWLfbfZl8Qp9IizFO3mv+nbmOr/WbmYztTmj/SbZTHziiNoAMQ5vyCAdroVfbQ49hfP25UxJDLlNx+GDGsREt64l/N3gXBxrm9yn8e9DwfKnYmBCw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724220769; c=relaxed/simple; bh=5VvtNNRd26LNsDJBn8KS15gBZ7elqdUOF4P/IROeTlM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=n4Hl9BVhYHpVJn1u40yBp637IUqRA9AHbkat0naXqKELINma+TVP/gKJg3oHL0UkVIsYtSIJHwvXgm2mE7MmCZRe1zdiqSk5QDiEV5Mlm0P7wq8MOfrlqAVE3iYEIrn+pGZnOTTcnkQxpIx2EbfS0wo/9NOyyn42wUDXgfSR75w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oMconoQN; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oMconoQN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38F4CC32782; Wed, 21 Aug 2024 06:12:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1724220769; bh=5VvtNNRd26LNsDJBn8KS15gBZ7elqdUOF4P/IROeTlM=; h=From:To:Cc:Subject:Date:Reply-to:From; b=oMconoQNO4fHb287yqv/3MxW9psNVZm7/q1Endg/QUgh5g3qfH0w3fv+zz9KrlONZ 0nv9N8BUgVf4dn5P7De/k9ohGtzoO/d9mQjuXei60/F2PIzFax3F9PhNX5luBDoWOb cpQ+0R/1IkCWfQNPIBS3sAVtRX9YB6ZFpo53R8ow= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-52894: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() Date: Wed, 21 Aug 2024 14:11:35 +0800 Message-ID: <2024082111-CVE-2023-52894-c8ee@gregkh> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4444; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=5VvtNNRd26LNsDJBn8KS15gBZ7elqdUOF4P/IROeTlM=; b=owGbwMvMwCRo6H6F97bub03G02pJDGlHW/5Hf/0S9XV21gOzP5kbLl7gmbpx656nb1S/HNL9o vF41/cP2h2xLAyCTAyyYoosX7bxHN1fcUjRy9D2NMwcViaQIQxcnAIwEX1Rhnkqj1ZrKgj7vZUQ fna+X7I6IyfonSfDPLOio+w7d/OfWi6s90hwyffEqyemvwcA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() In Google internal bug 265639009 we've received an (as yet) unreproducible crash report from an aarch64 GKI 5.10.149-android13 running device. AFAICT the source code is at: https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10 The call stack is: ncm_close() -> ncm_notify() -> ncm_do_notify() with the crash at: ncm_do_notify+0x98/0x270 Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...): // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification) 0B 0D 00 79 strh w11, [x8, #6] // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request) 6C 0A 00 B9 str w12, [x19, #8] // x10 (NULL) was read here from offset 0 of valid pointer x9 // IMHO we're reading 'cdev->gadget' and getting NULL // gadget is indeed at offset 0 of struct usb_composite_dev 2A 01 40 F9 ldr x10, [x9] // loading req->buf pointer, which is at offset 0 of struct usb_request 69 02 40 F9 ldr x9, [x19] // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed 4B 5D 40 B9 ldr w11, [x10, #0x5c] which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment: event->wLength = cpu_to_le16(8); req->length = NCM_STATUS_BYTECOUNT; /* SPEED_CHANGE data is up/down speeds in bits/sec */ data = req->buf + sizeof *event; data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); My analysis of registers and NULL ptr deref crash offset (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c) heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing: data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); which calls: ncm_bitrate(NULL) which then calls: gadget_is_superspeed(NULL) which reads ((struct usb_gadget *)NULL)->max_speed and hits a panic. AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. (remember there's a GKI KABI reservation of 16 bytes in struct work_struct) It's not at all clear to me how this is all supposed to work... but returning 0 seems much better than panic-ing... The Linux kernel CVE team has assigned CVE-2023-52894 to this issue. Affected and fixed versions =========================== Fixed in 4.14.304 with commit fef6b29671b6 Fixed in 4.19.271 with commit 63d161f29cd3 Fixed in 5.4.230 with commit a21da7f7aae6 Fixed in 5.10.165 with commit e92c70059178 Fixed in 5.15.90 with commit a69c8dfb85b4 Fixed in 6.1.8 with commit 09e4507ec8ef Fixed in 6.2 with commit c6ec929595c7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52894 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/usb/gadget/function/f_ncm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763 https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6 https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7 https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497 https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2