CVE-2024-26996

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error<br /> <br /> When ncm function is working and then stop usb0 interface for link down,<br /> eth_stop() is called. At this piont, accidentally if usb transport error<br /> should happen in usb_ep_enable(), &amp;#39;in_ep&amp;#39; and/or &amp;#39;out_ep&amp;#39; may not be enabled.<br /> <br /> After that, ncm_disable() is called to disable for ncm unbind<br /> but gether_disconnect() is never called since &amp;#39;in_ep&amp;#39; is not enabled.<br /> <br /> As the result, ncm object is released in ncm unbind<br /> but &amp;#39;dev-&gt;port_usb&amp;#39; associated to &amp;#39;ncm-&gt;port&amp;#39; is not NULL.<br /> <br /> And when ncm bind again to recover netdev, ncm object is reallocated<br /> but usb0 interface is already associated to previous released ncm object.<br /> <br /> Therefore, once usb0 interface is up and eth_start_xmit() is called,<br /> released ncm object is dereferrenced and it might cause use-after-free memory.<br /> <br /> [function unlink via configfs]<br /> usb0: eth_stop dev-&gt;port_usb=ffffff9b179c3200<br /> --&gt; error happens in usb_ep_enable().<br /> NCM: ncm_disable: ncm=ffffff9b179c3200<br /> --&gt; no gether_disconnect() since ncm-&gt;port.in_ep-&gt;enabled is false.<br /> NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200<br /> NCM: ncm_free: ncm free ncm=ffffff9b179c3200 port_usb=ffffff9b179c3200 port_usb=ffffff9b179c3200 dev-&gt;wrap()<br /> Unable to handle kernel paging request at virtual address dead00000000014f<br /> <br /> This patch addresses the issue by checking if &amp;#39;ncm-&gt;netdev&amp;#39; is not NULL at<br /> ncm_disable() to call gether_disconnect() to deassociate &amp;#39;dev-&gt;port_usb&amp;#39;.<br /> It&amp;#39;s more reasonable to check &amp;#39;ncm-&gt;netdev&amp;#39; to call gether_connect/disconnect<br /> rather than check &amp;#39;ncm-&gt;port.in_ep-&gt;enabled&amp;#39; since it might not be enabled<br /> but the gether connection might be established.