CVE-2024-42236

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the usb string copy() function in the Linux kernel's USB gadget configfs module. It involves an out-of-bounds (OOB) read and write when a userspace-provided string has a length of zero. This can lead to a denial of service. The vulnerability arises from the lack of a check for invalid strings that are too short, although there is already a validating check for strings that are too long. The OOB read and write occur in the forms if (str[0 - 1] == ' ') and str[0 - 1] = '0', respectively.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.