CVE-2024-46836: usb: gadget: aspeed_udc: validate endpoint index for ast udc
First published: Fri Sep 27 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | <6.1.110 | |
| Linux Kernel | >=6.2<6.6.51 | |
| Linux Kernel | >=6.7<6.10.10 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.11-1 | |
| debian/linux-6.1 | 6.1.119-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/31bd4fab49c0adc6228848357c1b1df9395858af
- https://git.kernel.org/stable/c/6fe9ca2ca389114c8da66e534c18273497843e8a
- https://git.kernel.org/stable/c/b2a50ffdd1a079869a62198a8d1441355c513c7c
- https://git.kernel.org/stable/c/ee0d382feb44ec0f445e2ad63786cd7f3f6a8199
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46836
- https://nvd.nist.gov/vuln/detail/CVE-2024-46836
- https://launchpad.net/bugs/cve/CVE-2024-46836
- https://security-tracker.debian.org/tracker/CVE-2024-46836
- https://ubuntu.com/security/CVE-2024-46836
- https://git.kernel.org/linus/ee0d382feb44ec0f445e2ad63786cd7f3f6a8199
- agent/title
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/weakness
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/references
- agent/trending
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.2
- version/linux kernel/6.7
- package-manager/debian