SB2024071753 - Out-of-bounds read in Linux kernel usb core driver
Published: July 17, 2024 Updated: May 13, 2025
Security Bulletin ID
SB2024071753
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2023-52886)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds read error within the get_bMaxPacketSize0(), hub_port_init(), hub_port_connect() and usb_reset_and_verify_device() functions in drivers/usb/core/hub.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f
- https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5
- https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee
- https://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848
- https://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5
- https://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.195
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.132
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.53
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.16
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.3
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6