CVE-2024-42236

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42236
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42236.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-42236
Downstream
Related
Published
2024-08-07T15:14:25.642Z
Modified
2026-05-28T03:55:16.771350687Z
Summary
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: configfs: Prevent OOB read/write in usbstringcopy()

Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if (str[0 - 1] == '\n') followed closely by an OOB write in the form str[0 - 1] = '\0'`.

There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42236.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
88af8bbe4ef781031ad3370847553f3b42ba0076
Fixed
a444c3fc264119801575ab086e03fb4952f23fd0
Fixed
c95fbdde87e39e5e0ae27f28bf6711edfb985caa
Fixed
e8474a10c535e6a2024c3b06e37e4a3a23beb490
Fixed
72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce
Fixed
2d16f63d8030903e5031853e79d731ee5d474e70
Fixed
d1205033e912f9332c1dbefa812e6ceb0575ce0a
Fixed
eecfefad0953b2f31aaefa058f7f348ff39c4bba
Fixed
6d3c721e686ea6c59e18289b400cc95c76e927e0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42236.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.10.0
Fixed
4.19.318
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.280
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.222
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.163
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.100
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.41
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.10

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42236.json"