{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-27401",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-27401"
  ],
  "published": "2024-05-13T10:30:00Z",
  "summary": "firewire: nosy: ensure user_length is taken into account when fetching packet contents",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: nosy: ensure user_length is taken into account when fetching packet contents\n\nEnsure that packet_buffer_get respects the user_length provided. If\nthe length of the head packet exceeds the user_length, packet_buffer_get\nwill now return 0 to signify to the user that no data were read\nand a larger buffer size is required. Helps prevent user space overflows.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.91",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27401"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/67f34f093c0f7bf33f5b4ae64d3d695a3b978285"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7b8c7bd2296e95b38a6ff346242356a2e7190239"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cca330c59c54207567a648357835f59df9a286bb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/79f988d3ffc1aa778fc5181bdfab312e57956c6b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4ee0941da10e8fdcdb34756b877efd3282594c1f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1fe60ee709436550f8cfbab01295936b868d5baa"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/539d51ac48bcfcfa1b3d4a85f8df92fa22c1d41c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/38762a0763c10c24a4915feee722d7aa6e73eb98"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerability is triggered by a local `read(2)` syscall on the `/dev/nosy` character device, where the caller supplies the undersized `user_length` that the kernel then ignores. Although the overflowing bytes originate from the IEEE 1394 bus, the vulnerable code path itself is entered and controlled entirely through a local file-descriptor operation.\nAC:L - The attacker simply calls `read()` with a small `count` while any traffic is present on the snooped 1394 bus (cycle-start packets alone arrive every 125 \u00b5s, and a bus reset queues a packet), making the overflow reliably and repeatedly reproducible with no memory-layout or timing conditions outside the attacker's control.\nPR:L - `nosy.c` contains no capability or permission checks whatsoever \u2014 reachability is decided solely by the permissions on `/dev/nosy`, which on the developer, lab, embedded and protocol-analysis systems where this sniffer is deployed is routinely opened up to a non-root group or passed into a container. Choosing the higher-severity option between L and H, an ordinary unprivileged user with the device node is sufficient.\nUI:N - The attacker performs the `read()` themselves and needs no victim action; the overflow occurs as soon as a packet longer than the supplied buffer is dequeued. No mount, no file open by another user, no configuration change by an administrator is required.\nS:U - The out-of-bounds write lands inside the address space of the process that issued the `read()`, and the compromised resources belong to the same security authority as the vulnerable kernel component. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `nosy_read()` returns a length greater than the requested `count`, so a caller following the standard read idiom consumes, prints, or logs memory located beyond its own buffer \u2014 an unbounded disclosure of adjacent process memory (heap pointers, keys, buffered data). The accompanying memory corruption is further leverageable to leak state from a privileged reader.\nI:H - Up to roughly 8 KB of externally supplied 1394 packet bytes are written past the end of the caller's stack or heap buffer, giving a large, content-controlled out-of-bounds write. Overwriting adjacent objects, saved registers, or function pointers in a nosy consumer that customarily runs as root yields control-flow hijack and arbitrary modification.\nA:H - The overflow reliably smashes adjacent memory and will SIGSEGV or abort the reading process (typically a root sniffer/logging daemon), and the copy can also fault mid-transfer leaving the buffer state inconsistent. Repeated triggering keeps the affected service permanently down."
    }
  }
}