Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: renesas_usb3: validate endpoint index in standard request handlers The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by validating the number of endpoints actually match up with the number the device has before attempting to dereference a pointer based on this math. This is just like what was done in commit ee0d382feb44 ("usb: gadget: aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
746bfe63bba37ad55956b7377c9af494e7e28929 to < 7caaf76207f50c77abfd788380e19b2c23a94415affected746bfe63bba37ad55956b7377c9af494e7e28929 to < c4e5ae6db2328d2d9ed55d3005a36c13faab0752affected746bfe63bba37ad55956b7377c9af494e7e28929 to < 360aa6e71870a175a6d86af905be2ca171639eb3affected746bfe63bba37ad55956b7377c9af494e7e28929 to < 1b2bfedccc4fb8c9572e1ea464f905424c91de2aaffected746bfe63bba37ad55956b7377c9af494e7e28929 to < adb8014599fdf0818d3d93f1f74e06cd0bdec08daffected746bfe63bba37ad55956b7377c9af494e7e28929 to < 44216e3dd4455b798899b50eedb0ec3831dff8e0affected746bfe63bba37ad55956b7377c9af494e7e28929 to < 37f430b2240655e6b0199a92aa1057e4d621be51affected746bfe63bba37ad55956b7377c9af494e7e28929 to < e3d42598f2995cdc07b7779874e7c5f8a1b773dbaffected746bfe63bba37ad55956b7377c9af494e7e28929 to < f880aac8a57ebd92abfa685d45424b2998ac1059affected
Linux Linux
Default version status: affected
4.5affected0 to < 4.5unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.83 to ≤ 6.12.*unaffected6.18.24 to ≤ 6.18.*unaffected6.19.14 to ≤ 6.19.*unaffected7.0.1 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7caaf76207f50c77abfd788380e19b2c23a94415 ↗
- https://git.kernel.org/stable/c/c4e5ae6db2328d2d9ed55d3005a36c13faab0752 ↗
- https://git.kernel.org/stable/c/360aa6e71870a175a6d86af905be2ca171639eb3 ↗
- https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a ↗
- https://git.kernel.org/stable/c/adb8014599fdf0818d3d93f1f74e06cd0bdec08d ↗
- https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0 ↗
- https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51 ↗
- https://git.kernel.org/stable/c/e3d42598f2995cdc07b7779874e7c5f8a1b773db ↗
- https://git.kernel.org/stable/c/f880aac8a57ebd92abfa685d45424b2998ac1059 ↗