can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Linux Linux)

CVE-2025-68343
Non disponible

En bref

Source
NVD
EPSS
EPSS 0.19 % · centile 8 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Deferred

Description

In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short.

Références

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected d08e973a77d128b25e01a08c34d89593fdf222da < 18cbce43363c9f84b90a92d57df341155eee0697 ; affected d08e973a77d128b25e01a08c34d89593fdf222da < 3433680b759646efcacc64fe36aa2e51ae34b8f0 ; affected d08e973a77d128b25e01a08c34d89593fdf222da < 616eee3e895b8ca0028163fcb1dce5e3e9dea322 ; affected d08e973a77d128b25e01a08c34d89593fdf222da < f31693dc3a584c0ad3937e857b59dbc1a7ed2b87 ; affected d08e973a77d128b25e01a08c34d89593fdf222da < 6fe9f3279f7d2518439a7962c5870c6e9ecbadcf
Linux · Linuxaffected 3.16 ; unaffected 0 < 3.16 ; unaffected 6.1.159 ≤ 6.1.* ; unaffected 6.6.119 ≤ 6.6.* ; unaffected 6.12.61 ≤ 6.12.* ; unaffected 6.17.11 ≤ 6.17.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD