CVE-2024-27405: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27405 affects the Linux kernel's USB gadget NCM (Network Control Model) functionality. The vulnerability was discovered when tethering is used over NCM with Windows 11 as host, where the gadget_giveback function sometimes has one byte appended at the end of a proper NTB (Network Transfer Block). This issue was identified and fixed in early 2024 (Kernel Git).

The vulnerability occurs in the NCM unwrap functionality when parsing NTBs. When the NTB is parsed, the unwrap call looks for any leftover bytes in SKB provided by u_ether, and if there are pending bytes, it treats them as a separate NTB. However, if this second NTB is faulty or corrupt, all the datagrams that were properly parsed in the first NTB and saved in rx_list are dropped. The issue specifically manifests with packets of sizes like 1025 bytes (1024 + 1) and 2049 bytes (2048 + 1), where the extra byte is a zero pad added by Windows to avoid USB ZLPs (Zero Length Packets) (Kernel Git).

The vulnerability can cause a denial of service condition by dropping valid network datagrams, potentially disrupting network communication between Linux devices using NCM tethering with Windows 11 hosts (CISA ADP).

The vulnerability requires a specific setup involving NCM tethering between a Linux device and a Windows 11 host. The issue is triggered by normal operation rather than malicious exploitation, making it more of a reliability issue than a security vulnerability (Kernel Git).

The issue has been fixed in the Linux kernel by modifying the NCM unwrap functionality to handle the Windows-added zero pad correctly. The fix involves checking if the remaining byte is a single zero byte and handling it appropriately instead of treating it as a separate NTB. Users should update their Linux kernel to a version containing the fix (Kernel Git).