CVE-2024-38616

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38616
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: re-fix fortified-memset warning The carl9170_tx_release() function sometimes triggers a fortified-memset warning in my randconfig builds: In file included from include/linux/string.h:254, from drivers/net/wireless/ath/carl9170/tx.c:40: In function 'fortify_memset_chk', inlined from 'carl9170_tx_release' at drivers/net/wireless/ath/carl9170/tx.c:283:2, inlined from 'kref_put' at include/linux/kref.h:65:3, inlined from 'carl9170_tx_put_skb' at drivers/net/wireless/ath/carl9170/tx.c:342:9: include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 493 | __write_overflow_field(p_size_field, size); Kees previously tried to avoid this by using memset_after(), but it seems this does not fully address the problem. I noticed that the memset_after() here is done on a different part of the union (status) than the original cast was from (rate_driver_data), which may confuse the compiler. Unfortunately, the memset_after() trick does not work on driver_rates[] because that is part of an anonymous struct, and I could not get struct_group() to do this either. Using two separate memset() calls on the two members does address the warning though.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 Patch
https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901 Patch
https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 Patch
https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b Patch
https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 Patch
https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 Patch
https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901 Patch
https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 Patch
https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b Patch
https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

01 Apr 2025, 18:27

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 - () https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 - Patch
References () https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901 - () https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901 - Patch
References () https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 - () https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 - Patch
References () https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b - () https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b - Patch
References () https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 - () https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 - Patch

21 Nov 2024, 09:26

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 - () https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 -
References () https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901 - () https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901 -
References () https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 - () https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 -
References () https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b - () https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b -
References () https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 - () https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 -

03 Jul 2024, 02:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2
CWE CWE-400

20 Jun 2024, 12:43

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: carl9170: volver a corregir la advertencia de memset fortificado La función carl9170_tx_release() a veces activa una advertencia de memset fortificado en mis compilaciones de randconfig: en el archivo incluido en include/linux/string. h:254, de drivers/net/wireless/ath/carl9170/tx.c:40: en la función 'fortify_memset_chk', insertado desde 'carl9170_tx_release' en drivers/net/wireless/ath/carl9170/tx.c:283:2 , incluido desde 'kref_put' en include/linux/kref.h:65:3, incluido desde 'carl9170_tx_put_skb' en drivers/net/wireless/ath/carl9170/tx.c:342:9: include/linux/fortify-string .h:493:25: error: llamada a '__write_overflow_field' declarada con advertencia de atributo: escritura detectada más allá del tamaño del campo (primer parámetro); ¿Quizás usar struct_group()? [-Werror=advertencia-atributo] 493 | __write_overflow_field(p_size_field, tamaño); Kees anteriormente intentó evitar esto usando memset_after(), pero parece que esto no soluciona completamente el problema. Me di cuenta de que memset_after() aquí se realiza en una parte diferente de la unión (estado) de la que provenía la conversión original (rate_driver_data), lo que puede confundir al compilador. Desafortunadamente, el truco memset_after() no funciona en driver_rates[] porque es parte de una estructura anónima y tampoco pude lograr que struct_group() hiciera esto. Sin embargo, el uso de dos llamadas memset() separadas en los dos miembros soluciona la advertencia.

19 Jun 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-19 14:15

Updated : 2025-04-01 18:27

NVD link : CVE-2024-38616

Mitre link : CVE-2024-38616

CVE.ORG link : CVE-2024-38616

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-400

Uncontrolled Resource Consumption