Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, bNumEmbMIDIJack and bLength are set incorrectly in these descriptors. This does not matter when the numbers of in and out ports are equal, but when they differ the host will receive broken descriptors with uninitialized stack memory leaking into the descriptor for whichever value is smaller. The precise meaning of "in" and "out" in the port counts is not clearly defined and can be confusing. But elsewhere the driver consistently uses this to match the USB meaning of IN and OUT viewed from the host, so that "in" ports send data to the host and "out" ports receive data from it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8933c3f79568263c90a46f06cf80419e6c63c97 to < 3a983390d14e8498f303fc5cb23ab7d696b815dbaffectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < 9f36a89dcb78cb7e37f487b04a16396ac18c0636affectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < d8e86700c8a8cf415e300a0921acd6a8f9b494f8affectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < 9f6860a9c11301b052225ca8825f8d2b1a5825bfaffectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < 6ae6dee9f005a2f3b739b85abb6f14a0935699e0affectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < 6b16761a928796e4b49e89a0b1ac284155172726affectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < a2d0694e1f111379c1efdf439dadd3cfd959fe9daffectedc8933c3f79568263c90a46f06cf80419e6c63c97 to < da1668997052ed1cb00322e1f3b63702615c9429affected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected5.4.291 to ≤ 5.4.*unaffected5.10.235 to ≤ 5.10.*unaffected5.15.179 to ≤ 5.15.*unaffected6.1.129 to ≤ 6.1.*unaffected6.6.79 to ≤ 6.6.*unaffected6.12.16 to ≤ 6.12.*unaffected6.13.4 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3a983390d14e8498f303fc5cb23ab7d696b815db ↗
- https://git.kernel.org/stable/c/9f36a89dcb78cb7e37f487b04a16396ac18c0636 ↗
- https://git.kernel.org/stable/c/d8e86700c8a8cf415e300a0921acd6a8f9b494f8 ↗
- https://git.kernel.org/stable/c/9f6860a9c11301b052225ca8825f8d2b1a5825bf ↗
- https://git.kernel.org/stable/c/6ae6dee9f005a2f3b739b85abb6f14a0935699e0 ↗
- https://git.kernel.org/stable/c/6b16761a928796e4b49e89a0b1ac284155172726 ↗
- https://git.kernel.org/stable/c/a2d0694e1f111379c1efdf439dadd3cfd959fe9d ↗
- https://git.kernel.org/stable/c/da1668997052ed1cb00322e1f3b63702615c9429 ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗