net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
Summary
GSD-2023-1002411: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path. Affects Kernel versions >= d40261236e8e278cb1936cb5e934262971692b10, < 723ef7b66f37c0841f5a451ccbce47ee1641e081. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/usb package in the Linux Kernel is responsible for handling USB network devices. It provides the necessary functionality for communication between the kernel and USB devices. The kalmia driver is a specific driver within net/usb that is used for Kalmia-based USB devices. These devices are susceptible to a vulnerability that allows the passing of act_len in the usb_bulk_msg error path.
Vulnerability Detail
The vulnerability in the kalmia driver arises from the improper handling of act_len in the error path of the usb_bulk_msg function. This can lead to potential security vulnerabilities, although the actual impact and attack plausibility have not been proven. The vulnerability was introduced in version v3.0 of the Linux Kernel by commit d40261236e8e278cb1936cb5e934262971692b10 and has been fixed in version v4.19.273 by commit 723ef7b66f37c0841f5a451ccbce47ee1641e081.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the net/usb kalmia driver in the Linux Kernel is vulnerable to a security issue related to the handling of act_len in the usb_bulk_msg error path. It is recommended to update the Linux Kernel to version v4.19.273 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/usb package is responsible for handling USB network devices in the Linux Kernel. It provides the necessary functionality for communication between the kernel and USB devices.
The kalmia driver is a specific driver within net/usb that is used for Kalmia-based USB devices.
The impact of this vulnerability is currently unknown as the actual attack plausibility has not been proven. However, it has the potential to introduce security vulnerabilities.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.273 or later.
For more details about this vulnerability, you can refer to the source information provided by the Cloud Security Alliance: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2023/1002xxx/GSD-2023-1002411.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
