usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
Userspace provided string 's' could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
`if (str[0 - 1] == '\n') followed closely by an OOB write in the form
`str[0 - 1] = '\0'`.
There is already a validating check to catch strings that are too long.
Let's supply an additional check for invalid strings that are too short.
No analysis available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4008-1 | linux-6.1 security update |
Debian DSA |
DSA-5747-1 | linux security update |
Ubuntu USN |
USN-7003-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7003-5 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7006-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7007-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7007-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7007-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7009-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7009-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7019-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-5 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-6 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7089-7 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-7090-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7095-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7156-1 | Linux kernel (GKE) vulnerabilities |
Mon, 03 Nov 2025 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 11 Sep 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 16 Aug 2024 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-99 |
Thu, 08 Aug 2024 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Thu, 08 Aug 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
Wed, 07 Aug 2024 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. | |
| Title | usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() | |
| References |
|
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-01-05T10:52:05.655Z
Reserved: 2024-07-30T07:40:12.252Z
Link: CVE-2024-42236
Updated: 2025-11-03T22:02:37.767Z
Status : Modified
Published: 2024-08-07T16:15:46.530
Modified: 2025-11-03T22:17:47.603
Link: CVE-2024-42236
OpenCVE Enrichment
No data.
Debian DLA
Debian DSA
Ubuntu USN