CVE-2024-50195

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-50195
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50195.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-50195
Downstream
Related
Published
2024-11-08T05:54:10.183Z
Modified
2026-03-11T07:48:57.918781745Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
posix-clock: Fix missing timespec64 check in pc_clock_settime()
Details

In the Linux kernel, the following vulnerability has been resolved:

posix-clock: Fix missing timespec64 check in pcclocksettime()

As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct's tvsec and tvnsec range before calling ptp->info->settime64().

As the man manual of clocksettime() said, if tp.tvsec is negative or tp.tvnsec is outside the range [0..999,999,999], it should return EINVAL, which include dynamic clocks which handles PTP clock, and the condition is consistent with timespec64valid(). As Thomas suggested, timespec64valid() only check the timespec is valid, but not ensure that the time is in a valid range, so check it ahead using timespec64validstrict() in pcclock_settime() and return -EINVAL if not valid.

There are some drivers that use tp->tvsec and tp->tvnsec directly to write registers without validity checks and assume that the higher layer has checked it, which is dangerous and will benefit from this, such as hclgeptpsettime(), igbptpsettimei210(), rcargen4ptp_settime(), and some drivers can remove the checks of itself.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50195.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0606f422b453f76c31ab2b1bd52943ff06a2dcf2
Fixed
29f085345cde24566efb751f39e5d367c381c584
Fixed
e0c966bd3e31911b57ef76cec4c5796ebd88e512
Fixed
673a1c5a2998acbd429d6286e6cad10f17f4f073
Fixed
c8789fbe2bbf75845e45302cba6ffa44e1884d01
Fixed
27abbde44b6e71ee3891de13e1a228aa7ce95bfe
Fixed
a3f169e398215e71361774d13bf91a0101283ac2
Fixed
1ff7247101af723731ea42ed565d54fb8f341264
Fixed
d8794ac20a299b647ba9958f6d657051fc51a540

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50195.json"