sr9700 RxFixup OOB

Vulnerability analysis

The SR9700 USB network driver's receive fixup function incorrectly validates incoming packet lengths. It subtracts the 4-byte Ethernet CRC from the reported length to obtain the payload size, but compares this payload size against the entire remaining USB receive buffer. However, the actual data copy starts after a 3-byte header, and the cursor advance consumes both that header and the CRC (7 bytes total overhead). This mismatch allows a malicious packet to claim a payload length that fits in the buffer but actually overruns it when the header offset is accounted for, corrupting adjacent kernel memory. The fix adds a check that the payload length fits within the buffer minus the full receive overhead (SR_RX_OVERHEAD). An attacker on the Ethernet network segment connected to the adapter can trigger this by sending a specially crafted frame; no privileges or user interaction are required.