Description
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length. Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to < c00ec53d7dec08134e97071850cc00ef000c5b77affected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < d9e91672526ffa279709b15490118aea1bdee714affected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < 72f96c2942f11a0ae8663adcb3d9ee986e07d4faaffected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < 695aea154bb2d453e6daada1510972fafd075285affected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < 3d0897ec623e422695d70d80ae456f89476c5328affected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < 185cb1fa38142a3cbf223dd8b3abb24217f330d3affected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < 21f0465fd86d77794aaed8e05f833634f68d178daffected080f40a6fa28dab299da7a652e444b1e2d9231e7 to < 0293dd153f9dbc1ddf5dacdccc76b363bce4a8eeaffected
Linux Linux
Default version status: affected
3.8affected0 to < 3.8unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77 ↗
- https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714 ↗
- https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa ↗
- https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285 ↗
- https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328 ↗
- https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3 ↗
- https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d ↗
- https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee ↗