Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qw_sign os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute. The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 76180d716f91f035d9c8639497cf5459b44e1a51 before b895dbed8ac9e12a5ffa1a2165575a8469f8340d; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before 9b45125501aad2dff7730970461b455b0e0658ee; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before f6da500b0f8106882598b6dec87fe37d653946cf; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before a28c486434634f6d1e120711d2b09f3eddea6c98; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before 7e94cb967778e074411940db4db97f22ed77560c; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before afbf39c0f2297c6abef6d670a82a2079b0836191; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before 36315a330e067f7773196940552feacb1debbef1; affected 76180d716f91f035d9c8639497cf5459b44e1a51 before f63edb54d8f738f9c21e2068c777ae1c097df6b7 |
| Linux / Linux | affected 4.13; unaffected 0 before 4.13; unaffected 5.10.270 through 5.10.*; unaffected 5.15.221 through 5.15.*; unaffected 6.1.188 through 6.1.*; unaffected 6.6.157 through 6.6.*; unaffected 6.12.110 through 6.12.*; unaffected 6.18.52 through 6.18.*; unaffected 7.2.6 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/b895dbed8ac9e12a5ffa1a2165575a8469f8340d
- https://git.kernel.org/stable/c/9b45125501aad2dff7730970461b455b0e0658ee
- https://git.kernel.org/stable/c/f6da500b0f8106882598b6dec87fe37d653946cf
- https://git.kernel.org/stable/c/a28c486434634f6d1e120711d2b09f3eddea6c98
- https://git.kernel.org/stable/c/7e94cb967778e074411940db4db97f22ed77560c
- https://git.kernel.org/stable/c/afbf39c0f2297c6abef6d670a82a2079b0836191
- https://git.kernel.org/stable/c/36315a330e067f7773196940552feacb1debbef1
- https://git.kernel.org/stable/c/f63edb54d8f738f9c21e2068c777ae1c097df6b7