In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows …
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length = w_length - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset; If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent memcpy(url_descriptor->URL, …
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/046870ff6b6f7b743c953c061043a9b30700d491
- https://git.kernel.org/stable/c/6c5dbc104dadd79fc2923497c20bae759a18758c
- https://git.kernel.org/stable/c/a20f0ccf45708af6e063c7234c215d364b00de25
- https://git.kernel.org/stable/c/f5869dfaa89854dcf34121036294d42d6c7acb8f
- https://git.kernel.org/stable/c/f8f5a8f48c7cae3fac85e04b593bd47939f9725f
Timeline
- nvd_ingest NVD