{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-36016", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.154Z", "datePublished": "2024-05-29T18:46:34.778Z", "dateUpdated": "2024-11-05T09:26:50.368Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:26:50.368Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\n Reason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\n Reason: Neither gsm->state nor gsm->len have been reset after\n reconfiguration.\n\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/n_gsm.c"], "versions": [{"version": "e1eaea46bb40", "lessThan": "9513d4148950", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "b229bc6c6ea9", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "0fb736c9931e", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "4c267110fc11", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "46f52c89a7e7", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "774d83b008ec", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "f126ce7305fe", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "b890d45aaf02", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb40", "lessThan": "47388e807f85", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/n_gsm.c"], "versions": [{"version": "2.6.35", "status": "affected"}, {"version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.316", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}], "title": "tty: n_gsm: fix possible out-of-bounds in gsm0_receive()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "e1eaea46bb40", "status": "affected", "lessThan": "b890d45aaf02", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "e1eaea46bb40", "status": "affected", "lessThan": "47388e807f85", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.6.35", "status": "affected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "e1eaea46bb40", "status": "affected", "lessThan": "f126ce7305fe", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "9513d4148950", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "b229bc6c6ea9", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "0fb736c9931e", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "4c267110fc11", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThanOrEqual": "46f52c89a7e7", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "774d83b008ec", "versionType": "custom"}, {"version": "0", "status": "unaffected", "lessThan": "2.6.35", "versionType": "custom"}, {"version": "4.19.316", "status": "unaffected", "lessThanOrEqual": "4.20", "versionType": "custom"}, {"version": "5.4.278", "status": "unaffected", "lessThanOrEqual": "5.5", "versionType": "custom"}, {"version": "5.10.219", "status": "unaffected", "lessThanOrEqual": "5.11", "versionType": "custom"}, {"version": "5.15.161", "status": "unaffected", "lessThanOrEqual": "5.16", "versionType": "custom"}, {"version": "6.1.93", "status": "unaffected", "lessThanOrEqual": "6.2", "versionType": "custom"}, {"version": "6.6.33", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "custom"}, {"version": "6.8.12", "status": "unaffected", "lessThanOrEqual": "6.9", "versionType": "custom"}, {"version": "6.9.3", "status": "unaffected", "lessThanOrEqual": "6.10", "versionType": "custom"}, {"version": "6.10", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-30T18:00:26.164343Z", "id": "CVE-2024-36016", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-22T17:58:33.311Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.609Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.609Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-30T18:00:26.164343Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "b890d45aaf02", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "47388e807f85", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "2.6.35"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "f126ce7305fe", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "9513d4148950", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "b229bc6c6ea9", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "0fb736c9931e", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "4c267110fc11", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "versionType": "custom", "lessThanOrEqual": "46f52c89a7e7"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "774d83b008ec", "versionType": "custom"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "custom"}, {"status": "unaffected", "version": "4.19.316", "versionType": "custom", "lessThanOrEqual": "4.20"}, {"status": "unaffected", "version": "5.4.278", "versionType": "custom", "lessThanOrEqual": "5.5"}, {"status": "unaffected", "version": "5.10.219", "versionType": "custom", "lessThanOrEqual": "5.11"}, {"status": "unaffected", "version": "5.15.161", "versionType": "custom", "lessThanOrEqual": "5.16"}, {"status": "unaffected", "version": "6.1.93", "versionType": "custom", "lessThanOrEqual": "6.2"}, {"status": "unaffected", "version": "6.6.33", "versionType": "custom", "lessThanOrEqual": "6.7"}, {"status": "unaffected", "version": "6.8.12", "versionType": "custom", "lessThanOrEqual": "6.9"}, {"status": "unaffected", "version": "6.9.3", "versionType": "custom", "lessThanOrEqual": "6.10"}, {"status": "unaffected", "version": "6.10", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-30T18:11:07.936Z"}}], "cna": {"title": "tty: n_gsm: fix possible out-of-bounds in gsm0_receive()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "9513d4148950", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "b229bc6c6ea9", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "0fb736c9931e", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "4c267110fc11", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "46f52c89a7e7", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "774d83b008ec", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "f126ce7305fe", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "b890d45aaf02", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "47388e807f85", "versionType": "git"}], "programFiles": ["drivers/tty/n_gsm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "custom"}, {"status": "unaffected", "version": "4.19.316", "versionType": "custom", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.278", "versionType": "custom", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.219", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "custom", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "custom", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "custom", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/tty/n_gsm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\n Reason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\n Reason: Neither gsm->state nor gsm->len have been reset after\n reconfiguration.\n\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:46:53.094Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36016", "state": "PUBLISHED", "dateUpdated": "2024-08-22T17:58:33.311Z", "dateReserved": "2024-05-17T13:50:33.154Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-29T18:46:34.778Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\n Reason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\n Reason: Neither gsm->state nor gsm->len have been reset after\n reconfiguration.\n\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: tty: n_gsm: corrige posibles fuera de los l\u00edmites en gsm0_receive() Suponiendo lo siguiente: - el lado A configura el n_gsm en modo de opci\u00f3n b\u00e1sica - el lado B env\u00eda el encabezado de un mensaje b\u00e1sico trama del modo de opci\u00f3n con longitud de datos 1 - el lado A cambia al modo de opci\u00f3n avanzada - el lado B env\u00eda 2 bytes de datos que exceden gsm->len Motivo: gsm->len no se usa en el modo de opci\u00f3n avanzada. - el lado A cambia al modo de opci\u00f3n b\u00e1sica - el lado B contin\u00faa enviando hasta que gsm0_receive() escribe m\u00e1s all\u00e1 de gsm->buf Motivo: Ni gsm->state ni gsm->len se han restablecido despu\u00e9s de la reconfiguraci\u00f3n. Solucione este problema cambiando gsm->count a gsm->len comparaci\u00f3n de igual a menor que. Tambi\u00e9n agregue comprobaciones de l\u00edmite superior contra la constante MAX_MRU en gsm0_receive() y gsm1_receive() para proteger contra la corrupci\u00f3n de memoria de gsm->len y gsm->mru. Todas las dem\u00e1s comprobaciones permanecen, ya que todav\u00eda necesitamos limitar los datos seg\u00fan la configuraci\u00f3n del usuario y el tama\u00f1o real del payload."}], "id": "CVE-2024-36016", "lastModified": "2024-11-21T09:21:26.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-29T19:15:48.297", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5102", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5101", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.16.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5692", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.119.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5692", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.119.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5692", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.119.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:6993", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.74.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:6997", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.37.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:6997", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.37.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:4533", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.73.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-15T00:00:00Z"}, {"advisory": "RHSA-2024:4554", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.73.1.rt14.358.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-15T00:00:00Z"}], "bugzilla": {"description": "kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive()", "id": "2283894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283894"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\nReason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\nReason: Neither gsm->state nor gsm->len have been reset after\nreconfiguration.\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size.", "A vulnerability was found in the Linux kernel's `n_gsm` driver, affecting the `tty` subsystem. It occurs when switching between basic and advanced option modes in GSM multiplexing, leading to potential out-of-bounds memory writes. This happens because certain state variables, like `gsm->len` and `gsm->state`, are not properly reset during mode changes. The issue could result in memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-36016", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36016\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36016\nhttps://lore.kernel.org/linux-cve-announce/2024052947-CVE-2024-36016-d30a@gregkh/T"], "threat_severity": "Moderate", "upstream_fix": "kernel 6.10-rc1"}