[PATCH net v3] net: usb: cdc_ncm: fix out-of-bounds read of chained NDP32 offset

[Ryan Prinz <rc4d5a@protonmail.com>]

The NDP offset read from dwNextNdpIndex on the 32-bit NTB (NDP32)
path is not checked for a negative value before use. A
device-supplied dwNextNdpIndex in the 0xFFFFFFF0-0xFFFFFFFF range
sign-converts to a small negative int. cdc_ncm_rx_verify_ndp32()'s
existing bounds check then double-wraps: promoting the negative int
to size_t first produces a huge value, and adding
sizeof(struct usb_cdc_ncm_ndp32) to that wraps it back down to a
small value that passes the "> skb_in->len" check, causing an
out-of-bounds read of up to 16 bytes before the skb's data buffer.

Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
Signed-off-by: Ryan Prinz <rc4d5a@protonmail.com>
---
v3:
 - Moved the fix from the cdc_ncm_rx_fixup() call site into
   cdc_ncm_rx_verify_ndp32() itself, at the actual point of the
   size_t wraparound, so it covers every caller instead of just the
   one chained-NDP jump. The old call-site check is dropped rather
   than kept alongside it, since it would just be dead code once the
   helper rejects the same value first.
 - Fixed the adjacent netif_dbg() to print ndpoffset with %d instead of
   %u, since it's a signed int and can now legitimately be negative.
 - Added a sentence on where the out-of-bounds bytes actually come from
   on real hardware.
 - Resent as plain text; v1/v2 picked up a PGP/MIME envelope from the
   mail client that leaked into the changelog.

Reproduced by calling cdc_ncm_rx_fixup() directly from a small
out-of-tree test module with a hand-crafted NTB. With memory-sanitizer
instrumentation enabled to pinpoint the vulnerability:

    BUG: KASAN: slab-out-of-bounds in cdc_ncm_rx_verify_ndp32+0x11e/0x130 [cdc_ncm]
    Read of size 2 at addr ffff88800fcd2a34 by task insmod/367
     cdc_ncm_rx_verify_ndp32+0x11e/0x130 [cdc_ncm]
     cdc_ncm_rx_fixup+0x7a3/0xed0 [cdc_ncm]

Scope/impact:
- Triggering the 32-bit NTB (NDP32) path requires the host driver to
  set CDC_NCM_FLAG_PREFER_NTB32 for the device. The only driver that
  does so unconditionally is huawei_cdc_ncm.c, for Huawei mobile
  broadband hardware. Local/physical-USB-attachment or
  compromised-device-firmware attack surface, not remote.
- Reachable offset range is -1 to -16, bounded by
  sizeof(struct usb_cdc_ncm_ndp32); the subsequent dpe32 array read
  always lands back inside the legitimate buffer, so this doesn't
  escalate into a larger OOB excursion.
- The rx skb is allocated by usbnet's rx_submit() via
  __netdev_alloc_skb()/__netdev_alloc_skb_ip_align(), both of which
  reserve NET_SKB_PAD (>= 32 bytes) of headroom ahead of skb->data.
  Since the reachable negative range is only -1 to -16, the read
  stays inside that same headroom/allocation and picks up stale
  bytes rather than crossing into unmapped memory.
- No out-of-bounds write found, and the leaked bytes only feed a
  signature-match comparison. There is no path found for them to
  reach a delivered packet or the device/attacker.

Given the local-only trigger and lack of a confirmed write primitive
or crash, my read is this doesn't need security@kernel.org handling,
but happy to redirect there if you think otherwise.

AI Disclosure: An AI assistant (Claude) was used to assist with the
analysis and testing. I have verified the vulnerability, the fix,
and the test results myself and take responsibility for this
contribution, per Documentation/process/coding-assistants.rst.

 drivers/net/usb/cdc_ncm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1698,8 +1698,9 @@ int cdc_ncm_rx_verify_ndp32(struct sk_buff *skb_in, int ndpoffset)
 	int ret = -EINVAL;
 	size_t ndp_len;

-	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
-		netif_dbg(dev, rx_err, dev->net, "invalid NDP offset  <%u>\n",
+	if (ndpoffset < 0 ||
+	    (ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
+		netif_dbg(dev, rx_err, dev->net, "invalid NDP offset  <%d>\n",
 			  ndpoffset);
 		goto error;
 	}
-- 
2.51.0