CVE-2024-42236 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.
A vulnerability in the Linux kernel's USB gadget configuration filesystem can lead to out-of-bounds (OOB) read and write operations. This issue arises because userspace can provide a string with a length of zero, which, if not properly checked, causes an OOB read followed by an OOB write. Although there is already a validation for strings that are too long, this vulnerability exploits the lack of a check for strings that are too short.
Users can upgrade to the patched version of the Linux kernel 6.1.119-1~deb11u1, available through the Debian package manager. Instructions for installing this update are provided in the Debian LTS advisory DLA-4008-1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | < 4.19.318 >= 4.20, < 5.4.280 >= 5.5, < 5.10.222 >= 5.11, < 5.15.163 >= 5.16, < 6.1.100 >= 6.2, < 6.6.41 >= 6.7, < 6.9.10 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 8, 2024 | Initial Analysis | [email protected] |
| Aug 7, 2024 | New CVE Received | kernel.org |