Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers. Drop the skb and increment the length error when the frag limit is reached. This matches the same fix that commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") did for the t7xx driver.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < 6807ff49bf796b3823b1e29f97b69316a40a9a94affected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < 0c5c65a17db729fc63ab656bdaaf0e675a9dbeacaffected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < 6053620fdbcd89fa7e755644efdaab78e0daaae7affected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < d4e1946bea8d6441835eb3fd09b19237ba366a6faffected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < a23b1b1aaf41e174181d5853a70e65d4d01e648caffected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < c183d5775129a0a7495bd61a6e57ec230dcf01e5affected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < ebf75c6301c4972a87542ebf2d994c6391eb5d46affected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < 9989938d13cc5ba8447eeed5a61acfcf61bc6801affected87cf65601e1709e57f7e28f0f7b3eb0a992c1782 to < 600dc40554dc5ad1e6f3af51f700228033f43ea7affected
Linux Linux
Default version status: affected
2.6.31affected0 to < 2.6.31unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.83 to ≤ 6.12.*unaffected6.18.24 to ≤ 6.18.*unaffected6.19.14 to ≤ 6.19.*unaffected7.0.1 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6807ff49bf796b3823b1e29f97b69316a40a9a94 ↗
- https://git.kernel.org/stable/c/0c5c65a17db729fc63ab656bdaaf0e675a9dbeac ↗
- https://git.kernel.org/stable/c/6053620fdbcd89fa7e755644efdaab78e0daaae7 ↗
- https://git.kernel.org/stable/c/d4e1946bea8d6441835eb3fd09b19237ba366a6f ↗
- https://git.kernel.org/stable/c/a23b1b1aaf41e174181d5853a70e65d4d01e648c ↗
- https://git.kernel.org/stable/c/c183d5775129a0a7495bd61a6e57ec230dcf01e5 ↗
- https://git.kernel.org/stable/c/ebf75c6301c4972a87542ebf2d994c6391eb5d46 ↗
- https://git.kernel.org/stable/c/9989938d13cc5ba8447eeed5a61acfcf61bc6801 ↗
- https://git.kernel.org/stable/c/600dc40554dc5ad1e6f3af51f700228033f43ea7 ↗