CVE-2024-27405

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs

It is observed sometimes when tethering is used over NCM with Windows 11

as host, at some instances, the gadget_giveback has one byte appended at

the end of a proper NTB. When the NTB is parsed, unwrap call looks for

any leftover bytes in SKB provided by u_ether and if there are any pending

bytes, it treats them as a separate NTB and parses it. But in case the

second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that

were parsed properly in the first NTB and saved in rx_list are dropped.

Adding a few custom traces showed the following:

[002] d..1 7828.532866: dwc3_gadget_giveback: ep1out:

req 000000003868811a length 1025/16384 zsI ==> 0

[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025

[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342

[002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_un

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References