In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMI…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usb_packet_leng…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a
- https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c
- https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88
- https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139
- https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110
- https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b
- https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3
- https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222
Timeline
- nvd_ingest NVD