In the Linux kernel, the following vulnerability has been resolved:
tty: ngsm: fix possible out-of-bounds in gsm0receive()
Assuming the following: - side A configures the ngsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAXMRU in gsm0receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the user configuration and actual payload size.
[
{
"id": "CVE-2024-36016-0486a156",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f126ce7305fe88f49cdabc6db4168b9318898ea3",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1789.0,
"function_hash": "261006394305135732221105986970411539047"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-061d8db3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f126ce7305fe88f49cdabc6db4168b9318898ea3",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"212622373014588927344127990693688919450",
"185377586283820136853294324879081122972",
"3998349256091976642834883317467677778",
"249556580272957944282235407311888577168",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-08b151ca",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47388e807f85948eefc403a8a5fdc5b406a65d5a",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"212622373014588927344127990693688919450",
"185377586283820136853294324879081122972",
"3998349256091976642834883317467677778",
"249556580272957944282235407311888577168",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-13eb8a8f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9513d4148950b05bc99fa7314dc883cc0e1605e5",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1569.0,
"function_hash": "268633965972584878890801370104188162617"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-16b1fb85",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f126ce7305fe88f49cdabc6db4168b9318898ea3",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1808.0,
"function_hash": "155826752398788955549637759819458186486"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-1d5ee017",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46f52c89a7e7d2691b97a9728e4591d071ca8abc",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1817.0,
"function_hash": "271207199027287510707153663770053495681"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-2b5052bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c267110fc110390704cc065edb9817fdd10ff54",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"212622373014588927344127990693688919450",
"185377586283820136853294324879081122972",
"3998349256091976642834883317467677778",
"249556580272957944282235407311888577168",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-3d3c7b2c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46f52c89a7e7d2691b97a9728e4591d071ca8abc",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1798.0,
"function_hash": "131233713614463996682021169280560449202"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-3d461996",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fb736c9931e02dbc7d9a75044c8e1c039e50f04",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1611.0,
"function_hash": "249863966363016596978525803919178174363"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-4bb340d3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b890d45aaf02b564e6cae2d2a590f9649330857d",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1789.0,
"function_hash": "261006394305135732221105986970411539047"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-50a937bf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1569.0,
"function_hash": "268633965972584878890801370104188162617"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-7dafb0cf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46f52c89a7e7d2691b97a9728e4591d071ca8abc",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"212622373014588927344127990693688919450",
"185377586283820136853294324879081122972",
"3998349256091976642834883317467677778",
"249556580272957944282235407311888577168",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-8ae45074",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9513d4148950b05bc99fa7314dc883cc0e1605e5",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1294.0,
"function_hash": "125185578377982893954195554421941040167"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-8b908c91",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c267110fc110390704cc065edb9817fdd10ff54",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1817.0,
"function_hash": "271207199027287510707153663770053495681"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-9909dda7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47388e807f85948eefc403a8a5fdc5b406a65d5a",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1789.0,
"function_hash": "261006394305135732221105986970411539047"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-ba9fa901",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"140883260156758596368369133261419002333",
"57692926775295918241552173170483442727",
"316843201884629456950246679573865969357",
"31730931553895957049948380365466149445",
"197315684759300745157418412739772052023",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-bf4423b9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b890d45aaf02b564e6cae2d2a590f9649330857d",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"212622373014588927344127990693688919450",
"185377586283820136853294324879081122972",
"3998349256091976642834883317467677778",
"249556580272957944282235407311888577168",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-c04a1c52",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c267110fc110390704cc065edb9817fdd10ff54",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1805.0,
"function_hash": "325686824039311749062748773167559985931"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-c4030aec",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b890d45aaf02b564e6cae2d2a590f9649330857d",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1808.0,
"function_hash": "155826752398788955549637759819458186486"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-cfdfc03f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47388e807f85948eefc403a8a5fdc5b406a65d5a",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1808.0,
"function_hash": "155826752398788955549637759819458186486"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-da5ec2d8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fb736c9931e02dbc7d9a75044c8e1c039e50f04",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"140883260156758596368369133261419002333",
"57692926775295918241552173170483442727",
"316843201884629456950246679573865969357",
"31730931553895957049948380365466149445",
"197315684759300745157418412739772052023",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-df033b76",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@774d83b008eccb1c48c14dc5486e7aa255731350",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1817.0,
"function_hash": "271207199027287510707153663770053495681"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-e10ca6b7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fb736c9931e02dbc7d9a75044c8e1c039e50f04",
"signature_version": "v1",
"target": {
"function": "gsm0_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1658.0,
"function_hash": "173980697085093235325375752732227655965"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-e55d8e9e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@774d83b008eccb1c48c14dc5486e7aa255731350",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1798.0,
"function_hash": "131233713614463996682021169280560449202"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-e6ec3088",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@774d83b008eccb1c48c14dc5486e7aa255731350",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"212622373014588927344127990693688919450",
"185377586283820136853294324879081122972",
"3998349256091976642834883317467677778",
"249556580272957944282235407311888577168",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-36016-f06a8728",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56",
"signature_version": "v1",
"target": {
"function": "gsm1_receive",
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"length": 1294.0,
"function_hash": "125185578377982893954195554421941040167"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-36016-f6b0e496",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9513d4148950b05bc99fa7314dc883cc0e1605e5",
"signature_version": "v1",
"target": {
"file": "drivers/tty/n_gsm.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"140883260156758596368369133261419002333",
"57692926775295918241552173170483442727",
"316843201884629456950246679573865969357",
"31730931553895957049948380365466149445",
"197315684759300745157418412739772052023",
"72858942024818117852037587068624633890",
"83776996755856058046177966163000299732",
"18436418652266084855833479909057305556",
"182956947585018197109282931509289636733"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]