Description
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer. When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
702171adeed3607ee9603ec30ce081411e36ae42 to < aed172a2e2330131f0977d2acd3ec8883f413ec1affected702171adeed3607ee9603ec30ce081411e36ae42 to < f10177e6c4575aedaea580ce67d792fab7a2235eaffected702171adeed3607ee9603ec30ce081411e36ae42 to < c703bbf8e9b4947e111c88d2ed09236a6772a471affected702171adeed3607ee9603ec30ce081411e36ae42 to < 1818974e1b5ef200e27f144c8cb8a246420bb54daffected702171adeed3607ee9603ec30ce081411e36ae42 to < 18f75b9cbdc3703f15965425ab69dee509b07785affected702171adeed3607ee9603ec30ce081411e36ae42 to < 1cf469026d4a2308eaa91d04dca4a900d07a5c2eaffected702171adeed3607ee9603ec30ce081411e36ae42 to < 2833e13e2b099546abf5d40a483b4eb04ddd1f7baffected702171adeed3607ee9603ec30ce081411e36ae42 to < 38a01c9700b0dcafe97dfa9dc7531bf4a245deffaffected
Linux Linux
Default version status: affected
2.6.32affected0 to < 2.6.32unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.18.17 to ≤ 6.18.*unaffected6.19.7 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/aed172a2e2330131f0977d2acd3ec8883f413ec1 ↗
- https://git.kernel.org/stable/c/f10177e6c4575aedaea580ce67d792fab7a2235e ↗
- https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471 ↗
- https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54d ↗
- https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785 ↗
- https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2e ↗
- https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7b ↗
- https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deff ↗