{"id":"CVE-2024-56717","state":"PUBLISHED","title":"net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()\n\nPackets injected by the CPU should have a SRC_PORT field equal to the\nCPU port module index in the Analyzer block (ocelot->num_phys_ports).\n\nThe blamed commit copied the ocelot_ifh_set_basic() call incorrectly\nfrom ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling\nwith \"x\", it calls with BIT_ULL(x), but the field is not a port mask,\nbut rather a single port index.\n\n[ side note: this is the technical debt of code duplication :( ]\n\nThe error used to be silent and doesn't appear to have other\nuser-visible manifestations, but with new changes in the packing\nlibrary, it now fails loudly as follows:\n\n------------[ cut here ]------------\nCannot store 0x40 inside bits 46-43 - will truncate\nsja1105 spi2.0: xmit timed out\nWARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198\nsja1105 spi2.0: timed out polling for tstamp\nCPU: 1 UID: 0 PID: 102 Comm: felix_xmit\nTainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605\nCall trace:\n __pack+0x90/0x198 (P)\n __pack+0x90/0x198 (L)\n packing+0x78/0x98\n ocelot_ifh_set_basic+0x260/0x368\n ocelot_port_inject_frame+0xa8/0x250\n felix_port_deferred_xmit+0x14c/0x258\n kthread_worker_fn+0x134/0x350\n kthread+0x114/0x138\n\nThe code path pertains to the ocelot switchdev driver and to the felix\nsecondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.\n\nThe messenger (packing) is not really to blame, so fix the original\ncommit instead.","publishedAt":"2024-12-29T08:48:49.958Z","updatedAt":"2026-08-05T11:46:14.927Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"06bcb9032e05ad717f9fd0a6e2fd3ae7f430fa31","status":"affected","lessThan":"59c4ca8d8d7918eb6e2df91d2c254827264be309","versionType":"git"},{"version":"ff7f554bbd75d5cbf00cded81d05147c6617e876","status":"affected","lessThan":"2f3c62ffe88116cd2a39cd73e01103535599970f","versionType":"git"},{"version":"e1b9e80236c540fa85d76e2d510d1b38e1968c5d","status":"affected","lessThan":"a8836eae3288c351acd3b2743d2fad2a4ee2bd56","versionType":"git"},{"version":"e1b9e80236c540fa85d76e2d510d1b38e1968c5d","status":"affected","lessThan":"2d5df3a680ffdaf606baa10636bdb1daf757832e","versionType":"git"},{"version":"be3a532167dd562ec38900c846e7ae6cc39aa2f1","status":"affected","versionType":"git"},{"version":"6.1.107","status":"affected","lessThan":"6.1.122","versionType":"semver"},{"version":"6.6.48","status":"affected","lessThan":"6.6.68","versionType":"semver"},{"version":"6.10.7","status":"affected","lessThan":"6.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mscc/ocelot.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.1.122","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.68","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.7","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mscc/ocelot.c"]}],"references":["https://git.kernel.org/stable/c/59c4ca8d8d7918eb6e2df91d2c254827264be309","https://git.kernel.org/stable/c/2f3c62ffe88116cd2a39cd73e01103535599970f","https://git.kernel.org/stable/c/a8836eae3288c351acd3b2743d2fad2a4ee2bd56","https://git.kernel.org/stable/c/2d5df3a680ffdaf606baa10636bdb1daf757832e","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56717.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56717","state":"PUBLISHED","datePublished":"2024-12-29T08:48:49.958Z","dateUpdated":"2026-08-05T11:46:14.927Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T15:00:39.858Z"},"containers":{"cna":{"title":"net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()\n\nPackets injected by the CPU should have a SRC_PORT field equal to the\nCPU port module index in the Analyzer block (ocelot->num_phys_ports).\n\nThe blamed commit copied the ocelot_ifh_set_basic() call incorrectly\nfrom ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling\nwith \"x\", it calls with BIT_ULL(x), but the field is not a port mask,\nbut rather a single port index.\n\n[ side note: this is the technical debt of code duplication :( ]\n\nThe error used to be silent and doesn't appear to have other\nuser-visible manifestations, but with new changes in the packing\nlibrary, it now fails loudly as follows:\n\n------------[ cut here ]------------\nCannot store 0x40 inside bits 46-43 - will truncate\nsja1105 spi2.0: xmit timed out\nWARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198\nsja1105 spi2.0: timed out polling for tstamp\nCPU: 1 UID: 0 PID: 102 Comm: felix_xmit\nTainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605\nCall trace:\n __pack+0x90/0x198 (P)\n __pack+0x90/0x198 (L)\n packing+0x78/0x98\n ocelot_ifh_set_basic+0x260/0x368\n ocelot_port_inject_frame+0xa8/0x250\n felix_port_deferred_xmit+0x14c/0x258\n kthread_worker_fn+0x134/0x350\n kthread+0x114/0x138\n\nThe code path pertains to the ocelot switchdev driver and to the felix\nsecondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.\n\nThe messenger (packing) is not really to blame, so fix the original\ncommit instead."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"06bcb9032e05ad717f9fd0a6e2fd3ae7f430fa31","status":"affected","lessThan":"59c4ca8d8d7918eb6e2df91d2c254827264be309","versionType":"git"},{"version":"ff7f554bbd75d5cbf00cded81d05147c6617e876","status":"affected","lessThan":"2f3c62ffe88116cd2a39cd73e01103535599970f","versionType":"git"},{"version":"e1b9e80236c540fa85d76e2d510d1b38e1968c5d","status":"affected","lessThan":"a8836eae3288c351acd3b2743d2fad2a4ee2bd56","versionType":"git"},{"version":"e1b9e80236c540fa85d76e2d510d1b38e1968c5d","status":"affected","lessThan":"2d5df3a680ffdaf606baa10636bdb1daf757832e","versionType":"git"},{"version":"be3a532167dd562ec38900c846e7ae6cc39aa2f1","status":"affected","versionType":"git"},{"version":"6.1.107","status":"affected","lessThan":"6.1.122","versionType":"semver"},{"version":"6.6.48","status":"affected","lessThan":"6.6.68","versionType":"semver"},{"version":"6.10.7","status":"affected","lessThan":"6.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mscc/ocelot.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.1.122","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.68","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.7","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mscc/ocelot.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/59c4ca8d8d7918eb6e2df91d2c254827264be309"},{"url":"https://git.kernel.org/stable/c/2f3c62ffe88116cd2a39cd73e01103535599970f"},{"url":"https://git.kernel.org/stable/c/a8836eae3288c351acd3b2743d2fad2a4ee2bd56"},{"url":"https://git.kernel.org/stable/c/2d5df3a680ffdaf606baa10636bdb1daf757832e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is the transmit/injection path of an Ethernet switch driver, reached whenever the kernel emits a frame on an ocelot/felix port — including replies to unauthenticated remote traffic (ARP/ICMP/TCP) and routed traffic, and specifically the ocelot-8021q PTP response path shown in the reported stack trace, where a remote PTP peer's Delay_Req elicits the injection.\nAC:L - The defect is unconditional and deterministic — every CPU-injected frame on affected hardware passes the out-of-range value to the packing helper, requiring no race, no memory grooming, and no state the attacker cannot induce.\nPR:N - No credentials or privileges are required; an unauthenticated remote peer that causes the device to transmit a single frame out an ocelot port (PTP exchange, ARP, ping, forwarded traffic) reaches the code, and locally the path is the ordinary ndo_start_xmit with no capability check.\nUI:N - No victim action is needed — normal packet transmission, which the attacker can induce remotely, is sufficient to reach the faulty field encoding.\nS:U - The fault and its consequences stay within the kernel's own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The injection frame header is a fixed 16-byte stack buffer written at compile-time-constant bit offsets, and the packing helper rejects/masks the oversized value, so no out-of-bounds read occurs and no kernel data is disclosed.\nI:N - No memory is corrupted and no attacker-controlled data is modified; the only altered state is a switch metadata field that was already zero before the offending commit, so there is no exploitable write or data-integrity loss.\nA:H - Each injected frame hits an unconditional WARN() (not WARN_ONCE) in the packing library, producing a stack dump per transmitted packet — this taints the kernel, floods the log and cripples throughput on embedded switch platforms, and panics outright on systems configured with panic_on_warn, all repeatable at will by a remote peer."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:46:14.927Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.107","versionEndExcluding":"6.1.122"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.48","versionEndExcluding":"6.6.68"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-56717","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T19:58:31.484052Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T20:07:06.591Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:53:08.192Z"}}]}}}