Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
88af8bbe4ef781031ad3370847553f3b42ba0076 to < a444c3fc264119801575ab086e03fb4952f23fd0affected88af8bbe4ef781031ad3370847553f3b42ba0076 to < c95fbdde87e39e5e0ae27f28bf6711edfb985caaaffected88af8bbe4ef781031ad3370847553f3b42ba0076 to < e8474a10c535e6a2024c3b06e37e4a3a23beb490affected88af8bbe4ef781031ad3370847553f3b42ba0076 to < 72b8ee0d9826e8ed00e0bdfce3e46b98419b37ceaffected88af8bbe4ef781031ad3370847553f3b42ba0076 to < 2d16f63d8030903e5031853e79d731ee5d474e70affected88af8bbe4ef781031ad3370847553f3b42ba0076 to < d1205033e912f9332c1dbefa812e6ceb0575ce0aaffected88af8bbe4ef781031ad3370847553f3b42ba0076 to < eecfefad0953b2f31aaefa058f7f348ff39c4bbaaffected88af8bbe4ef781031ad3370847553f3b42ba0076 to < 6d3c721e686ea6c59e18289b400cc95c76e927e0affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected4.19.318 to ≤ 4.19.*unaffected5.4.280 to ≤ 5.4.*unaffected5.10.222 to ≤ 5.10.*unaffected5.15.163 to ≤ 5.15.*unaffected6.1.100 to ≤ 6.1.*unaffected6.6.41 to ≤ 6.6.*unaffected6.9.10 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a444c3fc264119801575ab086e03fb4952f23fd0 ↗
- https://git.kernel.org/stable/c/c95fbdde87e39e5e0ae27f28bf6711edfb985caa ↗
- https://git.kernel.org/stable/c/e8474a10c535e6a2024c3b06e37e4a3a23beb490 ↗
- https://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce ↗
- https://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70 ↗
- https://git.kernel.org/stable/c/d1205033e912f9332c1dbefa812e6ceb0575ce0a ↗
- https://git.kernel.org/stable/c/eecfefad0953b2f31aaefa058f7f348ff39c4bba ↗
- https://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗