CVE-2024-50195

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> posix-clock: Fix missing timespec64 check in pc_clock_settime()<br /> <br /> As Andrew pointed out, it will make sense that the PTP core<br /> checked timespec64 struct&amp;#39;s tv_sec and tv_nsec range before calling<br /> ptp-&gt;info-&gt;settime64().<br /> <br /> As the man manual of clock_settime() said, if tp.tv_sec is negative or<br /> tp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL,<br /> which include dynamic clocks which handles PTP clock, and the condition is<br /> consistent with timespec64_valid(). As Thomas suggested, timespec64_valid()<br /> only check the timespec is valid, but not ensure that the time is<br /> in a valid range, so check it ahead using timespec64_valid_strict()<br /> in pc_clock_settime() and return -EINVAL if not valid.<br /> <br /> There are some drivers that use tp-&gt;tv_sec and tp-&gt;tv_nsec directly to<br /> write registers without validity checks and assume that the higher layer<br /> has checked it, which is dangerous and will benefit from this, such as<br /> hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(),<br /> and some drivers can remove the checks of itself.