In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: use correct buffer size when parsing configfs lists
This commit fixes uvc gadget support on 32-bit platforms.
Commit 0df28607c5cb ("usb: gadget: uvc: Generalise helper functions for reuse") introduced a helper function __uvcg_iter_item_entries() to aid with parsing lists of items on configfs attributes stores. This function is a generalization of another very similar function, which used a stack-allocated temporary buffer of fixed size for each item in the list and used the sizeof() operator to check for potential buffer overruns. The new function was changed to allocate the now variably sized temp buffer on heap, but wasn't properly updated to also check for max buffer size using the computed size instead of sizeof() operator.
As a result, the maximum item size was 7 (plus null terminator) on 64-bit platforms, and 3 on 32-bit ones. While 7 is accidentally just barely enough, 3 is definitely too small for some of UVC configfs attributes. For example, dwFrameInteval, specified in 100ns units, usually has 6-digit item values, e.g. 166666 for 60fps.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 30, 2024 |
| Suse | — | Upgrade kselftests-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade dtb-qcomUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-azure-livepatch-develUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-rtUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-develUpgrade gfs2-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade kernel-rtUpgrade dtb-socionextUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-appleUpgrade dtb-xilinxUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade dlm-kmp-defaultUpgrade kernel-default-develUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-rt-develUpgrade kernel-obs-qaUpgrade dtb-amdUpgrade kernel-devel-azureUpgrade dtb-mediatekUpgrade kernel-64kbUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-renesasUpgrade kernel-default-optionalUpgrade dtb-apmUpgrade dtb-exynosUpgrade dlm-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-devel-rtUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade kernel-symsUpgrade reiserfs-kmp-azureUpgrade kernel-sourceUpgrade kernel-docsUpgrade kernel-kvmsmall-develUpgrade kernel-default-baseUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-azureUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade dtb-armUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amazonUpgrade ocfs2-kmp-rtUpgrade dtb-hisiliconUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-defaultUpgrade kernel-azure-optionalUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade dtb-freescaleUpgrade kernel-syms-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-extraUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-source-rt | Jun 24, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-gkeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1013-awsUpgrade linux-image-awsUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-azureUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-generic-hwe-24.04 | Aug 9, 2024 | May 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub