CVE-2024-53156

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53156
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8 Patch
https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf Patch
https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540 Patch
https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab Patch
https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596 Patch
https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb Patch
https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849 Patch
https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4 Patch
https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Jan 2025, 16:02

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-129
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ath9k: agregue verificación de rango para conn_rsp_epid en htc_connect_service() Encontré el siguiente error en mi fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/ wireless/ath/ath9k/htc_hst.c:26:51 el índice 255 está fuera del rango para el tipo 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Nombre del hardware: PC estándar QEMU (i440FX + PIIX, 1996), BIOS 1.15.0- 1 01/04/2014 Cola de trabajo: eventos request_firmware_work_func Seguimiento de llamadas: dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0... Dado que se ha confirmado que este error es causado por una verificación insuficiente de conn_rsp_epid, creo que sería apropiado agregar una verificación de rango para conn_rsp_epid a htc_connect_service() para evitar que ocurra el error.
References () https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8 - () https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8 - Patch
References () https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf - () https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf - Patch
References () https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540 - () https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540 - Patch
References () https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab - () https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab - Patch
References () https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596 - () https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596 - Patch
References () https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb - () https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb - Patch
References () https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849 - () https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849 - Patch
References () https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4 - () https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4 - Patch
References () https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b - () https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

24 Dec 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-24 12:15

Updated : 2025-01-07 16:02

NVD link : CVE-2024-53156

Mitre link : CVE-2024-53156

CVE.ORG link : CVE-2024-53156

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index