Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
Userspace provided string ’s’ could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
if (str[0 - 1] == '\n') followed closely by an OOB write in the form str[0 - 1] = ‘\0’`.
There is already a validating check to catch strings that are too long. Let’s supply an additional check for invalid strings that are too short.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 6 ELS , CloudLinux 7 ELS , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS
- Affected packages:
- kernel @ 2.6.32 (+15 more)
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
Userspace provided string ’s’ could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
if (str[0 - 1] == '\n') followed closely by an OOB write in the form str[0 - 1] = ‘\0’`.
There is already a validating check to catch strings that are too long. Let’s supply an additional check for invalid strings that are too short.