In the Linux kernel, the following vulnerability has been resolved: comedi: ni_usb6501: fix NULL-deref in command paths The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing). Add the missing sanity checks to probe().
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | linux | < 5.15.3-1 | linux_5.15.3-1_all.deb |
Debian | 11 | all | linux | < 5.10.84-1 | linux_5.10.84-1_all.deb |
Debian | 999 | all | linux | < 5.15.3-1 | linux_5.15.3-1_all.deb |
Debian | 13 | all | linux | < 5.15.3-1 | linux_5.15.3-1_all.deb |