[PATCH] net: usb: cdc_ncm: fix out-of-bounds read of chained NDP32 offset

[PATCH] net: usb: cdc_ncm: fix out-of-bounds read of chained NDP32 offset

[Ryan Prinz]

[-- Attachment #1.1: Type: text/plain, Size: 2629 bytes --]

The NDP offset read from dwNextNdpIndex on the 32-bit NTB (NDP32)
path is not checked for a negative value before use. A
device-supplied dwNextNdpIndex in the 0xFFFFFFF0-0xFFFFFFFF range
sign-converts to a small negative int, bypassing the bounds check in
cdc_ncm_rx_verify_ndp32() via size_t wraparound, causing an
out-of-bounds read of up to 16 bytes before the skb's data buffer.

Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
Signed-off-by: Ryan Prinz <rc4d5a@protonmail.com>
---
Reproduced by calling cdc_ncm_rx_fixup() directly from a small
out-of-tree test module with a hand-crafted NTB. With memory-sanitizer
instrumentation enabled to pinpoint the vulnerability:

    BUG: KASAN: slab-out-of-bounds in cdc_ncm_rx_verify_ndp32+0x11e/0x130 [cdc_ncm]
    Read of size 2 at addr ffff88800fcd2a34 by task insmod/367
     cdc_ncm_rx_verify_ndp32+0x11e/0x130 [cdc_ncm]
     cdc_ncm_rx_fixup+0x7a3/0xed0 [cdc_ncm]

Scope/impact:
- Triggerin
g the 32-bit NTB (NDP32) path requires the host driver to
  set CDC_NCM_FLAG_PREFER_NTB32 for the device. The only driver that
  does so unconditionally is huawei_cdc_ncm.c, for Huawei mobile
  broadband hardware. Local/physical-USB-attachment or
  compromised-device-firmware attack surface, not remote.
- Reachable offset range is -1 to -16, bounded by
  sizeof(struct usb_cdc_ncm_ndp32); the subsequent dpe32 array read
  always lands back inside the legitimate buffer, so this doesn't
  escalate into a larger OOB excursion.
- No out-of-bounds write found, and the leaked bytes only feed a
  signature-match comparison. There is no path found for them to
  reach a delivered packet or the device/attacker.

Given the local-only trigger and lack of a confirmed write primitive
or crash, my read is this doesn't need security@kernel.org handling,
but happy to redirect there if you think otherwise.

AI Disclosure: An AI assistant (Claude) was used to assist with the
analysis and
 testing. I have verified the vulnerability, the fix,
and the test results myself and take responsibility for this
contribution, per Documentation/process/coding-assistants.rst.

 drivers/net/usb/cdc_ncm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 19db5a668..f5c8a6070 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1838,6 +1838,9 @@ int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
 	else
 		ndpoffset = le32_to_cpu(ndp.ndp32->dwNextNdpIndex);
 
+	if (ndpoffset < 0)
+		goto error;
+
 	if (ndpoffset && loopcount--)
 		goto next_ndp;
 
-- 
2.51.2

[-- Attachment #1.2: publickey - rc4d5a@protonmail.com - 0xE775BF83.asc --]
[-- Type: application/pgp-keys, Size: 897 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 322 bytes --]