CVE-2024-26996: usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fncm: Fix UAF ncm object at re-bind after usb ep transport error
When ncm function is working and then stop usb0 interface for link down, ethstop() is called. At this piont, accidentally if usb transport error should happen in usbepenable(), 'inep' and/or 'outep' may not be enabled.
After that, ncmdisable() is called to disable for ncm unbind but getherdisconnect() is never called since 'inep' is not enabled.
As the result, ncm object is released in ncm unbind but 'dev->portusb' associated to 'ncm->port' is not NULL.
And when ncm bind again to recover netdev, ncm object is reallocated but usb0 interface is already associated to previous released ncm object.
Therefore, once usb0 interface is up and ethstartxmit() is called, released ncm object is dereferrenced and it might cause use-after-free memory.
[function unlink via configfs] usb0: ethstop dev->portusb=ffffff9b179c3200 --> error happens in usbepenable(). NCM: ncmdisable: ncm=ffffff9b179c3200 --> no getherdisconnect() since ncm->port.inep->enabled is false. NCM: ncmunbind: ncm unbind ncm=ffffff9b179c3200 NCM: ncmfree: ncm free ncm=ffffff9b179c3200 <-- released ncm
[function link via configfs] NCM: ncmalloc: ncm alloc ncm=ffffff9ac4f8a000 NCM: ncmbind: ncm bind ncm=ffffff9ac4f8a000 NCM: ncmsetalt: ncm=ffffff9ac4f8a000 alt=0 usb0: ethopen dev->portusb=ffffff9b179c3200 <-- previous released ncm usb0: ethstart dev->portusb=ffffff9b179c3200 <-- ethstartxmit() --> dev->wrap() Unable to handle kernel paging request at virtual address dead00000000014f
This patch addresses the issue by checking if 'ncm->netdev' is not NULL at ncmdisable() to call getherdisconnect() to deassociate 'dev->portusb'. It's more reasonable to check 'ncm->netdev' to call getherconnect/disconnect rather than check 'ncm->port.inep->enabled' since it might not be enabled but the gether connection might be established.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
In the f_ncm implementation, modify ncm_disable() to check whether 'ncm->netdev' is not NULL before calling gether_disconnect() (to deassociate 'dev->port_usb'), instead of checking 'ncm->port.in_ep->enabled', which may be false/disabled while a gether connection can still be established.
Linux kernel usb gadget f_ncm (ncm_disable / gether_disconnect logic) Call gether_disconnect based on ncm->netdev instead of ncm->port.in_ep->enabled = Use condition (ncm->netdev != NULL) to call gether_disconnect()/deassociate dev->port_usb
Event History
Frequently Asked Questions
What is the nature of CVE-2024-26996?
CVE-2024-26996 is a use-after-free vulnerability in the Linux kernel related to the usb gadget f_ncm function.
What versions of the Linux kernel are affected by CVE-2024-26996?
CVE-2024-26996 affects Linux kernel versions from 5.15.157 up to, but not including, 6.9-rc1.
How can I mitigate the risks associated with CVE-2024-26996?
To mitigate CVE-2024-26996, you should upgrade to a fixed version of the Linux kernel, such as 6.1.123-1 or higher.
What are the symptoms of exploitation of CVE-2024-26996?
Symptoms of exploitation may include unexpected crashes or instability in systems utilizing the usb gadget f_ncm function.
Is there a patch for CVE-2024-26996?
Yes, kernel patches addressing CVE-2024-26996 have been released in the updated versions of the Linux kernel.