Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a one-byte combined status/count header. The usb-serial core sizes the interrupt-in buffer from the endpoint descriptor's wMaxPacketSize, and successful interrupt transfers can complete short when URB_SHORT_NOT_OK is not set. Check that the completed packet contains the selected header before reading it. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path, preventing out-of-bounds header-byte reads. KASAN report as below: KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0 Read of size 1 Call trace: cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009) __usb_hcd_giveback_urb() dummy_timer() [ johan: use constants in header length sanity checks ]
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3416eaa1f8f8d516b77de514e14cf8da256d28fb to < fcef31a5a85ccf3c313449a866ec6ed7e4132425affected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < aaa66708bfb1dca2acd219d1c1582f9f6d5492cbaffected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < 44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aedaffected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < be50533fe7068e86eb7adb81988e6d6a3f6dfe53affected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < 90664556916de22467097d4c8ceb716d597a5c32affected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < ae03453f2c809ca3cf73753269fa6184dea7160faffected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < 4a4cb0021ebe1fcadb52e04d19ed8d71470a530baffected3416eaa1f8f8d516b77de514e14cf8da256d28fb to < 9f9bfc80c67f35a275820da7e83a35dface08281affected
Linux Linux
Default version status: affected
2.6.26affected0 to < 2.6.26unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fcef31a5a85ccf3c313449a866ec6ed7e4132425 ↗
- https://git.kernel.org/stable/c/aaa66708bfb1dca2acd219d1c1582f9f6d5492cb ↗
- https://git.kernel.org/stable/c/44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed ↗
- https://git.kernel.org/stable/c/be50533fe7068e86eb7adb81988e6d6a3f6dfe53 ↗
- https://git.kernel.org/stable/c/90664556916de22467097d4c8ceb716d597a5c32 ↗
- https://git.kernel.org/stable/c/ae03453f2c809ca3cf73753269fa6184dea7160f ↗
- https://git.kernel.org/stable/c/4a4cb0021ebe1fcadb52e04d19ed8d71470a530b ↗
- https://git.kernel.org/stable/c/9f9bfc80c67f35a275820da7e83a35dface08281 ↗