In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes.
Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize.
Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing.
The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Suse | — | Upgrade kernel-64kb-develUpgrade kernel-debug-develUpgrade dtb-appleUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade dtb-apmUpgrade kernel-debug-livepatch-develUpgrade kernel-64kbUpgrade kernel-devel-rtUpgrade reiserfs-kmp-rtUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-azureUpgrade kernel-symsUpgrade dtb-amazonUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-kvmsmallUpgrade dlm-kmp-64kbUpgrade kernel-default-optionalUpgrade dtb-marvellUpgrade kernel-rt-develUpgrade gfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade dtb-socionextUpgrade kernel-develUpgrade dtb-amdUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade kernel-debugUpgrade dtb-broadcomUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade kernel-docs-htmlUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-extraUpgrade kernel-sourceUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-obs-qaUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-vdsoUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade dtb-mediatekUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-exynosUpgrade dtb-freescaleUpgrade cluster-md-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-rt_debug-develUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade kernel-defaultUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azureUpgrade kernel-syms-rtUpgrade kernel-rt-optionalUpgrade dtb-rockchipUpgrade kselftests-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade dtb-nvidiaUpgrade dlm-kmp-rtUpgrade kernel-azure-develUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-source-rtUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-qcomUpgrade dlm-kmp-azureUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-azureUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-cavium | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-oracle-5.4Upgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-oracleUpgrade linux-azure-fipsUpgrade linuxUpgrade linux-gkeopUpgrade linux-fipsUpgrade linux-ibm-5.4Upgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-aws-hweUpgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-azure-5.4Upgrade linux-hweUpgrade linux-gcpUpgrade linux-gcp-4.15Upgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-kvm | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub