← voltar
CVE-2025-38497

usb: gadget: configfs: Fix OOB read on empty string write

EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero. This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.
Produtos afetados
Linux · Linux

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →