In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value.
The driver will then proceed to parse the header located at that position, which will either oops or process some random value.
The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 1686.0, "function_hash": "259502968371364979099142503966240000156" }, "id": "CVE-2023-52655-0462fcfa", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c", "function": "aqc111_rx_fixup" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c386d73689a45d5ee8c1290827bce64056dddd" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "106164755847542329171127678027903074375", "107123208618357413787663292980526099459", "111699532752223055586837841727999380677", "216172799903764209513004847345209546098", "73994781545982983073621157776624580174", "257484953906958560059398591285377065899", "46509854043281686640951245668112689664", "212767354345995062353854464628953709762", "319589769178092389795051242164243425345", "149465886198902187396433181289117183626" ] }, "id": "CVE-2023-52655-054dcc0a", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ebf775f0541ae0d474836fa0cf3220e502f8e3e" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "106164755847542329171127678027903074375", "107123208618357413787663292980526099459", "111699532752223055586837841727999380677", "216172799903764209513004847345209546098", "73994781545982983073621157776624580174", "257484953906958560059398591285377065899", "46509854043281686640951245668112689664", "212767354345995062353854464628953709762", "319589769178092389795051242164243425345", "149465886198902187396433181289117183626" ] }, "id": "CVE-2023-52655-062997a8", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccab434e674ca95d483788b1895a70c21b7f016a" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "106164755847542329171127678027903074375", "107123208618357413787663292980526099459", "111699532752223055586837841727999380677", "216172799903764209513004847345209546098", "73994781545982983073621157776624580174", "257484953906958560059398591285377065899", "46509854043281686640951245668112689664", "212767354345995062353854464628953709762", "319589769178092389795051242164243425345", "149465886198902187396433181289117183626" ] }, "id": "CVE-2023-52655-0b3f8be9", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46412b2fb1f9cc895d6d4036bf24f640b5d86dab" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "106164755847542329171127678027903074375", "107123208618357413787663292980526099459", "111699532752223055586837841727999380677", "216172799903764209513004847345209546098", "73994781545982983073621157776624580174", "257484953906958560059398591285377065899", "46509854043281686640951245668112689664", "212767354345995062353854464628953709762", "319589769178092389795051242164243425345", "149465886198902187396433181289117183626" ] }, "id": "CVE-2023-52655-164e91d9", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69581c17608d81824dd497d9a54b6a5b6139975" }, { "signature_version": "v1", "digest": { "length": 1686.0, "function_hash": "259502968371364979099142503966240000156" }, "id": "CVE-2023-52655-2d698aa1", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c", "function": "aqc111_rx_fixup" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69581c17608d81824dd497d9a54b6a5b6139975" }, { "signature_version": "v1", "digest": { "length": 1686.0, "function_hash": "259502968371364979099142503966240000156" }, "id": "CVE-2023-52655-3c3324e8", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c", "function": "aqc111_rx_fixup" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46412b2fb1f9cc895d6d4036bf24f640b5d86dab" }, { "signature_version": "v1", "digest": { "length": 1686.0, "function_hash": "259502968371364979099142503966240000156" }, "id": "CVE-2023-52655-6064b22b", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c", "function": "aqc111_rx_fixup" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ebf775f0541ae0d474836fa0cf3220e502f8e3e" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "106164755847542329171127678027903074375", "107123208618357413787663292980526099459", "111699532752223055586837841727999380677", "216172799903764209513004847345209546098", "73994781545982983073621157776624580174", "257484953906958560059398591285377065899", "46509854043281686640951245668112689664", "212767354345995062353854464628953709762", "319589769178092389795051242164243425345", "149465886198902187396433181289117183626" ] }, "id": "CVE-2023-52655-6c5a9265", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c386d73689a45d5ee8c1290827bce64056dddd" }, { "signature_version": "v1", "digest": { "length": 1686.0, "function_hash": "259502968371364979099142503966240000156" }, "id": "CVE-2023-52655-b9fe522e", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c", "function": "aqc111_rx_fixup" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84f2e5b3e70f08fce3cb1ff73414631c5e490204" }, { "signature_version": "v1", "digest": { "length": 1686.0, "function_hash": "259502968371364979099142503966240000156" }, "id": "CVE-2023-52655-d23c46ca", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c", "function": "aqc111_rx_fixup" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccab434e674ca95d483788b1895a70c21b7f016a" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "106164755847542329171127678027903074375", "107123208618357413787663292980526099459", "111699532752223055586837841727999380677", "216172799903764209513004847345209546098", "73994781545982983073621157776624580174", "257484953906958560059398591285377065899", "46509854043281686640951245668112689664", "212767354345995062353854464628953709762", "319589769178092389795051242164243425345", "149465886198902187396433181289117183626" ] }, "id": "CVE-2023-52655-fb1e9e9a", "deprecated": false, "target": { "file": "drivers/net/usb/aqc111.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84f2e5b3e70f08fce3cb1ff73414631c5e490204" } ] }