CVE-2024-49938
"Qualcomm Atheros ath9k_htc Linux Kernelskb Trimming Buffer Underflow"
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call. The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
INFO
Published Date :
Oct. 21, 2024, 6:15 p.m.
Last Modified :
Nov. 13, 2024, 3:25 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-49938.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-49938 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-49938 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 13, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/012ae530afa0785102360de452745d33c99a321b No Types Assigned https://git.kernel.org/stable/c/012ae530afa0785102360de452745d33c99a321b Patch Changed Reference Type https://git.kernel.org/stable/c/2c230210ec0ae6ed08306ac70dc21c24b817bb95 No Types Assigned https://git.kernel.org/stable/c/2c230210ec0ae6ed08306ac70dc21c24b817bb95 Patch Changed Reference Type https://git.kernel.org/stable/c/6a875220670475d9247e576c15dc29823100a4e4 No Types Assigned https://git.kernel.org/stable/c/6a875220670475d9247e576c15dc29823100a4e4 Patch Changed Reference Type https://git.kernel.org/stable/c/94745807f3ebd379f23865e6dab196f220664179 No Types Assigned https://git.kernel.org/stable/c/94745807f3ebd379f23865e6dab196f220664179 Patch Changed Reference Type https://git.kernel.org/stable/c/a9f4e28e8adaf0715bd4e01462af0a52ee46b01f No Types Assigned https://git.kernel.org/stable/c/a9f4e28e8adaf0715bd4e01462af0a52ee46b01f Patch Changed Reference Type https://git.kernel.org/stable/c/b02eb7c86ff2ef1411c3095ec8a52b13f68db04f No Types Assigned https://git.kernel.org/stable/c/b02eb7c86ff2ef1411c3095ec8a52b13f68db04f Patch Changed Reference Type https://git.kernel.org/stable/c/d1f2fbc6a769081503f6ffedbb5cd1ac497f0e77 No Types Assigned https://git.kernel.org/stable/c/d1f2fbc6a769081503f6ffedbb5cd1ac497f0e77 Patch Changed Reference Type https://git.kernel.org/stable/c/e37e348835032d6940ec89308cc8996ded691d2d No Types Assigned https://git.kernel.org/stable/c/e37e348835032d6940ec89308cc8996ded691d2d Patch Changed Reference Type https://git.kernel.org/stable/c/e6b9bf32e0695e4f374674002de0527d2a6768eb No Types Assigned https://git.kernel.org/stable/c/e6b9bf32e0695e4f374674002de0527d2a6768eb Patch Added CWE NIST CWE-824 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.10.227 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.168 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.113 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.55 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.11 up to (excluding) 6.11.3 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 08, 2024
Action Type Old Value New Value Added Reference kernel.org https://git.kernel.org/stable/c/e6b9bf32e0695e4f374674002de0527d2a6768eb [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d1f2fbc6a769081503f6ffedbb5cd1ac497f0e77 [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call. The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it. Added Reference kernel.org https://git.kernel.org/stable/c/b02eb7c86ff2ef1411c3095ec8a52b13f68db04f [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/012ae530afa0785102360de452745d33c99a321b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6a875220670475d9247e576c15dc29823100a4e4 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e37e348835032d6940ec89308cc8996ded691d2d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2c230210ec0ae6ed08306ac70dc21c24b817bb95 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a9f4e28e8adaf0715bd4e01462af0a52ee46b01f [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/94745807f3ebd379f23865e6dab196f220664179 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-49938 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-49938
weaknesses.