PT-2024-6074 · Microsoft+5 · Windows 11+5
Published
2024-02-19
·
Updated
2025-03-28
·
CVE-2024-27405
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the Linux kernel's handling of Network Control Messages (NCMs) when used for tethering with Windows 11 as the host. In some cases, an extra byte is appended to the end of a properly parsed NCM, causing the kernel to treat it as a separate NCM and attempt to parse it. If this second NCM is faulty or corrupt, all previously parsed datagrams are dropped. This behavior has been observed with packets of sizes 1025 and 2048 bytes. According to the Windows driver, no Zero-Length Packet (ZLP) is needed if the block length is non-zero, as it already indicates the transfer size. However, some in-market NCM devices rely on ZLP when the block length is a multiple of the maximum packet size, leading to the kernel padding an extra zero at the end of the transfer to avoid being a multiple of the maximum packet size.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Windows 11