Description
In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. xusbatm initialize the USB device IDs dynamically so it can just use driver_info too. Even with conversion, xusbatm still cannot support dynamic IDs, so also set no_dynamic_id.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
733260ff9c45bd4db60f45d17e8560a4a68dff4d to < ee4006c2175e8b50ff5d47a54bff52eb29bb1f0daffected733260ff9c45bd4db60f45d17e8560a4a68dff4d to < 5086f5639197f321b766cec0dce383492eaf2305affected733260ff9c45bd4db60f45d17e8560a4a68dff4d to < fad6cab36474758abf55c6419dd79a06a27fcefcaffected733260ff9c45bd4db60f45d17e8560a4a68dff4d to < 8944ef1bfda537aaf329c82e7a5f9faf61340aa9affected733260ff9c45bd4db60f45d17e8560a4a68dff4d to < f7db611d98b68d15661561d2cefa774208774cccaffected733260ff9c45bd4db60f45d17e8560a4a68dff4d to < eb6cd6d3d8abeac5d7e8251b898067184afdad8aaffected
Linux Linux
Default version status: affected
2.6.16affected0 to < 2.6.16unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ee4006c2175e8b50ff5d47a54bff52eb29bb1f0d ↗
- https://git.kernel.org/stable/c/5086f5639197f321b766cec0dce383492eaf2305 ↗
- https://git.kernel.org/stable/c/fad6cab36474758abf55c6419dd79a06a27fcefc ↗
- https://git.kernel.org/stable/c/8944ef1bfda537aaf329c82e7a5f9faf61340aa9 ↗
- https://git.kernel.org/stable/c/f7db611d98b68d15661561d2cefa774208774ccc ↗
- https://git.kernel.org/stable/c/eb6cd6d3d8abeac5d7e8251b898067184afdad8a ↗