Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index). Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
370af734dfaf8336b496b386e194648e097e248a to < 9c8c6825a750fcd3efbe922847ca70ccd5a66857affected370af734dfaf8336b496b386e194648e097e248a to < a1c0deeba4a46481543d6b09c665f758c54c3a1aaffected370af734dfaf8336b496b386e194648e097e248a to < d13f650a3485b58c124b3cda45597e8002c9c833affected370af734dfaf8336b496b386e194648e097e248a to < 11413d7ed42174b8f5d8d0b6a25d10dc88239b21affected370af734dfaf8336b496b386e194648e097e248a to < 5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3affected370af734dfaf8336b496b386e194648e097e248a to < d328fdc607fa1bb668ad512e1c918a120f78f337affected370af734dfaf8336b496b386e194648e097e248a to < fc9e54e22845c4da29588ca0986cb7c795b5a262affected370af734dfaf8336b496b386e194648e097e248a to < 6b1c8a9403a26cb0fed7a648916c74dc236da591affected
Linux Linux
Default version status: affected
3.17affected0 to < 3.17unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.152 to ≤ 6.6.*unaffected6.12.104 to ≤ 6.12.*unaffected6.18.45 to ≤ 6.18.*unaffected7.1.9 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9c8c6825a750fcd3efbe922847ca70ccd5a66857 ↗
- https://git.kernel.org/stable/c/a1c0deeba4a46481543d6b09c665f758c54c3a1a ↗
- https://git.kernel.org/stable/c/d13f650a3485b58c124b3cda45597e8002c9c833 ↗
- https://git.kernel.org/stable/c/11413d7ed42174b8f5d8d0b6a25d10dc88239b21 ↗
- https://git.kernel.org/stable/c/5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3 ↗
- https://git.kernel.org/stable/c/d328fdc607fa1bb668ad512e1c918a120f78f337 ↗
- https://git.kernel.org/stable/c/fc9e54e22845c4da29588ca0986cb7c795b5a262 ↗
- https://git.kernel.org/stable/c/6b1c8a9403a26cb0fed7a648916c74dc236da591 ↗