CVSS 7.8 · High EPSS 0,32%
Kerentanan Out-of-bounds Read pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 3.9 hingga sebelum 4.9.303 |
| linux | linux kernel | Versi 4.10 hingga sebelum 4.14.268 |
| linux | linux kernel | Versi 4.15 hingga sebelum 4.19.231 |
| linux | linux kernel | Versi 4.20 hingga sebelum 5.4.180 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.101 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.24 |
| linux | linux kernel | Versi 5.16 hingga sebelum 5.16.10 |
| linux | linux kernel | Versi 5.17 rc1 |
| linux | linux kernel | Versi 5.17 rc2 |
| linux | linux kernel | Versi 5.17 rc3 |