In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after
reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.
References
Configurations
No configuration.
History
15 Jul 2024, 07:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
03 Jul 2024, 02:02
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-125 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.7 |
27 Jun 2024, 12:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
16 Jun 2024, 13:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
12 Jun 2024, 10:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary |
|
30 May 2024, 10:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
29 May 2024, 19:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-05-29 19:15
Updated : 2024-07-15 07:15
NVD link : CVE-2024-36016
Mitre link : CVE-2024-36016
CVE.ORG link : CVE-2024-36016
JSON object : View
Products Affected
No product.
CWE
CWE-125
Out-of-bounds Read