Description
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification. Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
dbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < e794bd67b3faf98af46f958897f6b91412c7d2a9affecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < e3eec3005de44e7f37d8d7724be636446516ab42affecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < ae87f505917e703ae3b487d9663d78826ff43608affecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < 5de7df75ef3a2756b25fe3d582a4a2970444fe5aaffecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < 69020fa089f1bf0e1a10a15265f31b143a846409affecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < 75f6d3da2cc646983f41807ef98851569c12bca9affecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < f141b01eaa58ac7e323931d670318aa247bff087affecteddbf3e7f654c0f06a932b8fcafac78de9d0b81d68 to < 52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcdaffected
Linux Linux
Default version status: affected
4.6affected0 to < 4.6unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.93 to ≤ 6.12.*unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9 ↗
- https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42 ↗
- https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608 ↗
- https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a ↗
- https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409 ↗
- https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9 ↗
- https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087 ↗
- https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd ↗