Bug 2320510 (CVE-2024-49938)

Summary:	CVE-2024-49938 kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, rhel-process-autobot, vkumar, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel's `ath9k_htc` Wi-Fi driver. An issue exists where the `skb_trim()` function, used for resetting the length of a socket buffer (skb) before resubmitting a USB Request Block (urb), can encounter an uninitialized length value in certain error conditions. A local attacker could potentially exploit this vulnerability to cause a denial of service by triggering these error paths.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2321087
Bug Blocks:

Description OSIDB Bzimport 2024-10-21 19:06:56 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit

Syzbot points out that skb_trim() has a sanity check on the existing length of
the skb, which can be uninitialised in some error paths. The intent here is
clearly just to reset the length to zero before resubmitting, so switch to
calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length()
already contains a call to skb_reset_tail_pointer(), so remove the redundant
call.

The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar
usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.

Comment 1 Robb Gatica 2024-10-22 17:10:16 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102127-CVE-2024-49938-5a61@gregkh/T

Comment 2 errata-xmlrpc 2025-05-13 08:30:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966