CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the USB Video Class (UVC) gadget, specifically in the `uvc_send_response()` function, where insufficient validation allows for potential buffer overflows when handling user-supplied data. This can lead to memory corruption, which may be exploited to execute arbitrary code or crash the system. Organizations using Linux systems that implement UVC functionality should prioritize addressing this issue to mitigate potential security risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length); req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data. Clamp req->length to sizeof(data->data) as well.