Description
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() creates a temporary buffer and copies the SG list to the new linear buffer. But if the kzalloc_node() fails, then the following sg_pcopy_to_buffer() can lead to crash since it tries to memcpy to NULL pointer. So return -ENOMEM if kzalloc returns null pointer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2017a1e58472a27e532b9644b4a61dfe18f6baac to < 4a49d24fdec0a802aa686a567a3989a9fdf4e5ddaffected2017a1e58472a27e532b9644b4a61dfe18f6baac to < b2c898469dfc388f619c6c972a28466cbb1442eaaffected2017a1e58472a27e532b9644b4a61dfe18f6baac to < 620b6cf2f1a270f48d38e6b8ce199c1acb3e90f4affected2017a1e58472a27e532b9644b4a61dfe18f6baac to < 962300a360d24c5be5a188cda48da58a37e4304daffected2017a1e58472a27e532b9644b4a61dfe18f6baac to < 7b6cc33593d7ccfc3011b290849cfa899db46757affected2017a1e58472a27e532b9644b4a61dfe18f6baac to < be95cc6d71dfd0cba66e3621c65413321b398052affected
Linux Linux
Default version status: affected
5.11affected0 to < 5.11unaffected5.15.154 to ≤ 5.15.*unaffected6.1.84 to ≤ 6.1.*unaffected6.6.24 to ≤ 6.6.*unaffected6.7.12 to ≤ 6.7.*unaffected6.8.3 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4a49d24fdec0a802aa686a567a3989a9fdf4e5dd ↗
- https://git.kernel.org/stable/c/b2c898469dfc388f619c6c972a28466cbb1442ea ↗
- https://git.kernel.org/stable/c/620b6cf2f1a270f48d38e6b8ce199c1acb3e90f4 ↗
- https://git.kernel.org/stable/c/962300a360d24c5be5a188cda48da58a37e4304d ↗
- https://git.kernel.org/stable/c/7b6cc33593d7ccfc3011b290849cfa899db46757 ↗
- https://git.kernel.org/stable/c/be95cc6d71dfd0cba66e3621c65413321b398052 ↗