{
  "id": "CVE-2024-38616",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2024-06-19T14:15:21.403",
  "lastModified": "2024-11-21T09:26:29.657",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: re-fix fortified-memset warning\n\nThe carl9170_tx_release() function sometimes triggers a fortified-memset\nwarning in my randconfig builds:\n\nIn file included from include/linux/string.h:254,\n                 from drivers/net/wireless/ath/carl9170/tx.c:40:\nIn function 'fortify_memset_chk',\n    inlined from 'carl9170_tx_release' at drivers/net/wireless/ath/carl9170/tx.c:283:2,\n    inlined from 'kref_put' at include/linux/kref.h:65:3,\n    inlined from 'carl9170_tx_put_skb' at drivers/net/wireless/ath/carl9170/tx.c:342:9:\ninclude/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]\n  493 |                         __write_overflow_field(p_size_field, size);\n\nKees previously tried to avoid this by using memset_after(), but it seems\nthis does not fully address the problem. I noticed that the memset_after()\nhere is done on a different part of the union (status) than the original\ncast was from (rate_driver_data), which may confuse the compiler.\n\nUnfortunately, the memset_after() trick does not work on driver_rates[]\nbecause that is part of an anonymous struct, and I could not get\nstruct_group() to do this either. Using two separate memset() calls\non the two members does address the warning though."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: carl9170: volver a corregir la advertencia de memset fortificado La funci\u00f3n carl9170_tx_release() a veces activa una advertencia de memset fortificado en mis compilaciones de randconfig: en el archivo incluido en include/linux/string. h:254, de drivers/net/wireless/ath/carl9170/tx.c:40: en la funci\u00f3n 'fortify_memset_chk', insertado desde 'carl9170_tx_release' en drivers/net/wireless/ath/carl9170/tx.c:283:2 , incluido desde 'kref_put' en include/linux/kref.h:65:3, incluido desde 'carl9170_tx_put_skb' en drivers/net/wireless/ath/carl9170/tx.c:342:9: include/linux/fortify-string .h:493:25: error: llamada a '__write_overflow_field' declarada con advertencia de atributo: escritura detectada m\u00e1s all\u00e1 del tama\u00f1o del campo (primer par\u00e1metro); \u00bfQuiz\u00e1s usar struct_group()? [-Werror=advertencia-atributo] 493 | __write_overflow_field(p_size_field, tama\u00f1o); Kees anteriormente intent\u00f3 evitar esto usando memset_after(), pero parece que esto no soluciona completamente el problema. Me di cuenta de que memset_after() aqu\u00ed se realiza en una parte diferente de la uni\u00f3n (estado) de la que proven\u00eda la conversi\u00f3n original (rate_driver_data), lo que puede confundir al compilador. Desafortunadamente, el truco memset_after() no funciona en driver_rates[] porque es parte de una estructura an\u00f3nima y tampoco pude lograr que struct_group() hiciera esto. Sin embargo, el uso de dos llamadas memset() separadas en los dos miembros soluciona la advertencia."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}