net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
Summary
GSD-2023-1002418: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path. Affects Kernel versions >= d40261236e8e278cb1936cb5e934262971692b10, < 1b5de7d44890b78519acbcc80d8d1f23ff2872e5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/usb package in the Linux Kernel is responsible for handling USB network devices. It provides the necessary functionality for communication between the kernel and USB devices. The kalmia driver is a specific driver within net/usb that is used for a particular USB network device. This driver utilizes the usb_bulk_msg function to send and receive data to and from the device.
Vulnerability Detail
The vulnerability in the kalmia driver arises from passing the 'act_len' parameter in the error path of the usb_bulk_msg function. This can lead to potential security issues, although the exact impact and attack plausibility have not been proven. The vulnerability was introduced in version v3.0 of the Linux Kernel by commit d40261236e8e278cb1936cb5e934262971692b10. However, it has been fixed in version v4.14.306 by commit 1b5de7d44890b78519acbcc80d8d1f23ff2872e5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net/usb kalmia driver in the Linux Kernel is susceptible to a vulnerability that involves passing the 'act_len' parameter in the error path of the usb_bulk_msg function. This vulnerability has been fixed in version v4.14.306 of the Linux Kernel. It is advised to update to this version or later to mitigate the potential security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/usb package in the Linux Kernel is responsible for handling USB network devices and facilitating communication between the kernel and these devices.
The kalmia driver is a specific driver within the net/usb package that is used for a particular USB network device.
The usb_bulk_msg function is used by the kalmia driver to send and receive data to and from the USB network device.
The exact impact of this vulnerability is not yet proven. However, it has the potential to introduce security issues in the kalmia driver.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.306 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
