In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, bNumEmbMIDIJack and bLength are set incorrectly in these descriptors. This does not matter when the numbers of in and out ports are equal, but when they differ the host will receive broken descriptors with uninitialized stack memory leaking into the descriptor for whichever value is smaller. The precise meaning of "in" and "out" in the port counts is not clearly defined and can be confusing. But elsewhere the driver consistently uses this to match the USB meaning of IN and OUT viewed from the host, so that "in" ports send data to the host and "out" ports receive data from it.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths Mientras que los conectores MIDI están configurados correctamente, y los descriptores de endpoint MIDIStreaming están llenos con la información correcta, bNumEmbMIDIJack y bLength están configurados incorrectamente en estos descriptores. Esto no importa cuando los números de puertos de entrada y salida son iguales, pero cuando difieren, el host recibirá descriptores rotos con memoria de pila no inicializada que se filtra en el descriptor para el valor que sea menor. El significado preciso de "entrada" y "salida" en los recuentos de puertos no está claramente definido y puede ser confuso. Pero en otros lugares, el controlador usa esto constantemente para que coincida con el significado USB de IN y OUT visto desde el host, de modo que los puertos "de entrada" envían datos al host y los puertos "de salida" reciben datos de él.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b436000> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd370265940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b57e100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340ad4e40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b437900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340ad7b40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340ad6080> | Operating System |
| linux | linux_kernel | 6.14 | <built-in method update of dict object at 0x7fd340227080> | Operating System |
| linux | linux_kernel | 6.14 | <built-in method update of dict object at 0x7fd340ad57c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:* |