Description
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d08e973a77d128b25e01a08c34d89593fdf222da to < 18cbce43363c9f84b90a92d57df341155eee0697affectedd08e973a77d128b25e01a08c34d89593fdf222da to < 3433680b759646efcacc64fe36aa2e51ae34b8f0affectedd08e973a77d128b25e01a08c34d89593fdf222da to < 616eee3e895b8ca0028163fcb1dce5e3e9dea322affectedd08e973a77d128b25e01a08c34d89593fdf222da to < f31693dc3a584c0ad3937e857b59dbc1a7ed2b87affectedd08e973a77d128b25e01a08c34d89593fdf222da to < 6fe9f3279f7d2518439a7962c5870c6e9ecbadcfaffected
Linux Linux
Default version status: affected
3.16affected0 to < 3.16unaffected6.1.159 to ≤ 6.1.*unaffected6.6.119 to ≤ 6.6.*unaffected6.12.61 to ≤ 6.12.*unaffected6.17.11 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/18cbce43363c9f84b90a92d57df341155eee0697 ↗
- https://git.kernel.org/stable/c/3433680b759646efcacc64fe36aa2e51ae34b8f0 ↗
- https://git.kernel.org/stable/c/616eee3e895b8ca0028163fcb1dce5e3e9dea322 ↗
- https://git.kernel.org/stable/c/f31693dc3a584c0ad3937e857b59dbc1a7ed2b87 ↗
- https://git.kernel.org/stable/c/6fe9f3279f7d2518439a7962c5870c6e9ecbadcf ↗