Description
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback` functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position `pos` to the next packet boundary using `round_up()` function. However, if zero-length command is found exactly on a packet boundary (i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up` function will return the unchanged value of `pos`. This prevents `pos` to be increased, causing an infinite loop in the parsing logic. This patch fixes this in the function by using `pos + 1` instead. This ensures that even if `pos` is on a boundary, the calculation is based on `pos + 1`, forcing `round_up()` to always return the next aligned boundary.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7259124eac7d1b76b41c7a9cb2511a30556deebe to < 58343e0a4d43699f0e2f5b169384bbe4c0217addaffected7259124eac7d1b76b41c7a9cb2511a30556deebe to < 69c7825df64e24dc15d31631a1fc9145324b1345affected7259124eac7d1b76b41c7a9cb2511a30556deebe to < 028e89c7e8b4346302e88df01cc50e0a1f05791aaffected7259124eac7d1b76b41c7a9cb2511a30556deebe to < e9dd83a75a7274edef21682c823bf0b66d7b6b7faffected7259124eac7d1b76b41c7a9cb2511a30556deebe to < 0897cea266e39166a36111059ba147192b36592faffected7259124eac7d1b76b41c7a9cb2511a30556deebe to < bd8135a560cf6e64f0b98ed4daadf126a38f7f48affected7259124eac7d1b76b41c7a9cb2511a30556deebe to < 0c73772cd2b8cc108d5f5334de89ad648d89b9ecaffected
Linux Linux
Default version status: affected
4.19affected0 to < 4.19unaffected5.10.247 to ≤ 5.10.*unaffected5.15.197 to ≤ 5.15.*unaffected6.1.159 to ≤ 6.1.*unaffected6.6.119 to ≤ 6.6.*unaffected6.12.61 to ≤ 6.12.*unaffected6.17.11 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/58343e0a4d43699f0e2f5b169384bbe4c0217add ↗
- https://git.kernel.org/stable/c/69c7825df64e24dc15d31631a1fc9145324b1345 ↗
- https://git.kernel.org/stable/c/028e89c7e8b4346302e88df01cc50e0a1f05791a ↗
- https://git.kernel.org/stable/c/e9dd83a75a7274edef21682c823bf0b66d7b6b7f ↗
- https://git.kernel.org/stable/c/0897cea266e39166a36111059ba147192b36592f ↗
- https://git.kernel.org/stable/c/bd8135a560cf6e64f0b98ed4daadf126a38f7f48 ↗
- https://git.kernel.org/stable/c/0c73772cd2b8cc108d5f5334de89ad648d89b9ec ↗