In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow<\/p>\n
The 0xffff length sentinel detects a router reboot and schedules
\nre-enabling of ethernet mode, but then falls through to the rest
\nof the loop body. The next check is<\/p>\n
\t} else if (len > CX82310_MTU) {<\/p>\n
which is the else of the just-matched if — it never fires for
\nlen == 0xffff. The MTU bound that normally caps the
\nincomplete-packet save path is silently bypassed.<\/p>\n
With 0xffff > skb->len always true (rx_urb_size is 4096), the
\nincomplete-packet branch saves dev->partial_len = skb->len bytes
\ninto dev->partial_data. partial_data is kmalloc(hard_mtu) =
\nkmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the
\n2-byte header pull can be up to 4094. A device that sends a
\n4096-byte URB starting with [0xff 0xff] therefore copies 4094
\ndevice-provided bytes into a buffer allocated for 1516 bytes,
\nexceeding its requested size by 2578 bytes.<\/p>\n
The next URB then reads dev->partial_len (4094) back from the same
\n1516-byte buffer and dev->partial_rem (65535 – 4094 = 61441) from
\nthe new URB’s ~4KB skb, both well past their allocations, and
\ndelivers the spliced result as a 64KB “frame” to the network
\nstack.<\/p>\n
Bail out of rx_fixup after scheduling the re-enable work; the
\nremainder of a reboot-marker URB is not meaningful packet data.
\nThis restores the invariant that partial_len < CX82310_MTU + 2 on
\nthe save path, since every other route there has already passed
\nthe MTU check.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow<\/p>\n
The 0xffff length sentinel dete<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29180","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}