CVE-2024-56717

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()

Packets injected by the CPU should have a SRC_PORT field equal to the

CPU port module index in the Analyzer block (ocelot->num_phys_ports).

The blamed commit copied the ocelot_ifh_set_basic() call incorrectly

from ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling

with "x", it calls with BIT_ULL(x), but the field is not a port mask,

but rather a single port index.

[ side note: this is the technical debt of code duplication :( ]

The error used to be silent and doesn't appear to have other

user-visible manifestations, but with new changes in the packing

library, it now fails loudly as follows:

------------[ cut here ]------------

Cannot store 0x40 inside bits 46-43 - will truncate

sja1105 spi2.0: xmit timed out

WARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198

sja1105 spi2.0: timed out polling for tstamp

CPU: 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References