{"vulnerability": "CVE-2024-56717", "sightings": [{"uuid": "084249b6-6717-4345-976f-25226c72ad3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-56717", "type": "seen", "source": "https://t.me/cvedetector/13869", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-56717 - \"DNX: Linux Kernel Net: Incorrect SRC_PORT Field In Ocelot Ifh Set Basic\"\", \n  \"Content\": \"CVE ID : CVE-2024-56717 \nPublished : Dec. 29, 2024, 9:15 a.m. | 24\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nnet: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()  \n  \nPackets injected by the CPU should have a SRC_PORT field equal to the  \nCPU port module index in the Analyzer block (ocelot->num_phys_ports).  \n  \nThe blamed commit copied the ocelot_ifh_set_basic() call incorrectly  \nfrom ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling  \nwith \"x\", it calls with BIT_ULL(x), but the field is not a port mask,  \nbut rather a single port index.  \n  \n[ side note: this is the technical debt of code duplication :( ]  \n  \nThe error used to be silent and doesn't appear to have other  \nuser-visible manifestations, but with new changes in the packing  \nlibrary, it now fails loudly as follows:  \n  \n------------[ cut here ]------------  \nCannot store 0x40 inside bits 46-43 - will truncate  \nsja1105 spi2.0: xmit timed out  \nWARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198  \nsja1105 spi2.0: timed out polling for tstamp  \nCPU: 1 UID: 0 PID: 102 Comm: felix_xmit  \nTainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605  \nCall trace:  \n __pack+0x90/0x198 (P)  \n __pack+0x90/0x198 (L)  \n packing+0x78/0x98  \n ocelot_ifh_set_basic+0x260/0x368  \n ocelot_port_inject_frame+0xa8/0x250  \n felix_port_deferred_xmit+0x14c/0x258  \n kthread_worker_fn+0x134/0x350  \n kthread+0x114/0x138  \n  \nThe code path pertains to the ocelot switchdev driver and to the felix  \nsecondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.  \n  \nThe messenger (packing) is not really to blame, so fix the original  \ncommit instead. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"29 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-29T10:41:18.000000Z"}, {"uuid": "214a56c8-0ac6-4b53-b050-b84759d7a047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-56717", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113735318485953258", "content": "", "creation_timestamp": "2024-12-29T09:07:14.370448Z"}, {"uuid": "7de6af2c-2361-455b-808d-6701dbd12f5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-56717", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3legom4ilkp2o", "content": "", "creation_timestamp": "2024-12-29T09:15:47.589326Z"}, {"uuid": "110e6705-2131-4288-bd47-b34fe96fe2e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2024-56717", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}]}