CVE-2024-42236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42236", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.252Z", "datePublished": "2024-08-07T15:14:25.642Z", "dateUpdated": "2026-08-05T11:36:01.503Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:01.503Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Prevent OOB read/write in usb_string_copy()\n\nUserspace provided string 's' could trivially have the length zero. Left\nunchecked this will firstly result in an OOB read in the form\n`if (str[0 - 1] == '\\n') followed closely by an OOB write in the form\n`str[0 - 1] = '\\0'`.\n\nThere is already a validating check to catch strings that are too long.\nLet's supply an additional check for invalid strings that are too short."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable input is a local `write(2)` to a USB gadget configfs attribute file (`/sys/kernel/config/usb_gadget/.../manufacturer`), not data from a USB peer or the network \u2014 no hardware, UDC binding, or physical access is needed.\nAC:L - A single deterministic `write(fd, \"\\0\", 1)` always drives `strlen()` to 0 and performs the `str[-1]` out-of-bounds access; there is no race and no condition outside the attacker's control, and heap grooming for the OOB write is attacker-driven via repeated gadget/string alloc-free cycles.\nPR:L - Some local access to the gadget configfs attributes is required, and these files are routinely delegated to non-root identities (Android chowns `/config/usb_gadget` to system:system for the non-root USB gadget HAL; embedded images commonly group-delegate it), so an unprivileged/low-privileged local process can reach the path.\nUI:N - The attacker performs the configfs write themselves; no victim action, mount, or interaction of any kind is needed.\nS:U - The out-of-bounds read and write stay within kernel heap memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The bug is an out-of-bounds heap read plus heap corruption of an adjacent slab object, and such corruption is leveragable for information disclosure once the attacker grooms `kmalloc-128` to place a chosen victim object before the string buffer.\nI:H - `str[-1] = '\\0'` is a genuine out-of-bounds heap write that clears the trailing byte of the neighbouring `kmalloc-128` object \u2014 an attacker-groomable NUL-byte poisoning primitive that corrupts kernel data structures.\nA:H - The OOB access can fault on an unmapped/guard page (KFENCE, DEBUG_PAGEALLOC) or trip KASAN, and clearing a byte of an adjacent live slab object readily leads to a later oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/configfs.c"], "versions": [{"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "a444c3fc264119801575ab086e03fb4952f23fd0", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "c95fbdde87e39e5e0ae27f28bf6711edfb985caa", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "e8474a10c535e6a2024c3b06e37e4a3a23beb490", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "2d16f63d8030903e5031853e79d731ee5d474e70", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "d1205033e912f9332c1dbefa812e6ceb0575ce0a", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "eecfefad0953b2f31aaefa058f7f348ff39c4bba", "status": "affected", "versionType": "git"}, {"version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "6d3c721e686ea6c59e18289b400cc95c76e927e0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/configfs.c"], "versions": [{"version": "3.10", "status": "affected"}, {"version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.318", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.280", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.100", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.41", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "4.19.318"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.4.280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.41"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.9.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a444c3fc264119801575ab086e03fb4952f23fd0"}, {"url": "https://git.kernel.org/stable/c/c95fbdde87e39e5e0ae27f28bf6711edfb985caa"}, {"url": "https://git.kernel.org/stable/c/e8474a10c535e6a2024c3b06e37e4a3a23beb490"}, {"url": "https://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce"}, {"url": "https://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70"}, {"url": "https://git.kernel.org/stable/c/d1205033e912f9332c1dbefa812e6ceb0575ce0a"}, {"url": "https://git.kernel.org/stable/c/eecfefad0953b2f31aaefa058f7f348ff39c4bba"}, {"url": "https://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0"}], "title": "usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42236", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:14:04.317460Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:32.140Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:37.767Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:37.767Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42236", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:14:04.317460Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:24.285Z"}}], "cna": {"title": "usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable input is a local `write(2)` to a USB gadget configfs attribute file (`/sys/kernel/config/usb_gadget/.../manufacturer`), not data from a USB peer or the network \u2014 no hardware, UDC binding, or physical access is needed.\nAC:L - A single deterministic `write(fd, \"\\0\", 1)` always drives `strlen()` to 0 and performs the `str[-1]` out-of-bounds access; there is no race and no condition outside the attacker's control, and heap grooming for the OOB write is attacker-driven via repeated gadget/string alloc-free cycles.\nPR:L - Some local access to the gadget configfs attributes is required, and these files are routinely delegated to non-root identities (Android chowns `/config/usb_gadget` to system:system for the non-root USB gadget HAL; embedded images commonly group-delegate it), so an unprivileged/low-privileged local process can reach the path.\nUI:N - The attacker performs the configfs write themselves; no victim action, mount, or interaction of any kind is needed.\nS:U - The out-of-bounds read and write stay within kernel heap memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The bug is an out-of-bounds heap read plus heap corruption of an adjacent slab object, and such corruption is leveragable for information disclosure once the attacker grooms `kmalloc-128` to place a chosen victim object before the string buffer.\nI:H - `str[-1] = '\\0'` is a genuine out-of-bounds heap write that clears the trailing byte of the neighbouring `kmalloc-128` object \u2014 an attacker-groomable NUL-byte poisoning primitive that corrupts kernel data structures.\nA:H - The OOB access can fault on an unmapped/guard page (KFENCE, DEBUG_PAGEALLOC) or trip KASAN, and clearing a byte of an adjacent live slab object readily leads to a later oops or panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "a444c3fc264119801575ab086e03fb4952f23fd0", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "c95fbdde87e39e5e0ae27f28bf6711edfb985caa", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "e8474a10c535e6a2024c3b06e37e4a3a23beb490", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "2d16f63d8030903e5031853e79d731ee5d474e70", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "d1205033e912f9332c1dbefa812e6ceb0575ce0a", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "eecfefad0953b2f31aaefa058f7f348ff39c4bba", "versionType": "git"}, {"status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "lessThan": "6d3c721e686ea6c59e18289b400cc95c76e927e0", "versionType": "git"}], "programFiles": ["drivers/usb/gadget/configfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"status": "unaffected", "version": "0", "lessThan": "3.10", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.318", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.280", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.222", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.163", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.100", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.41", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.10", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/configfs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a444c3fc264119801575ab086e03fb4952f23fd0"}, {"url": "https://git.kernel.org/stable/c/c95fbdde87e39e5e0ae27f28bf6711edfb985caa"}, {"url": "https://git.kernel.org/stable/c/e8474a10c535e6a2024c3b06e37e4a3a23beb490"}, {"url": "https://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce"}, {"url": "https://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70"}, {"url": "https://git.kernel.org/stable/c/d1205033e912f9332c1dbefa812e6ceb0575ce0a"}, {"url": "https://git.kernel.org/stable/c/eecfefad0953b2f31aaefa058f7f348ff39c4bba"}, {"url": "https://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Prevent OOB read/write in usb_string_copy()\n\nUserspace provided string 's' could trivially have the length zero. Left\nunchecked this will firstly result in an OOB read in the form\n`if (str[0 - 1] == '\\n') followed closely by an OOB write in the form\n`str[0 - 1] = '\\0'`.\n\nThere is already a validating check to catch strings that are too long.\nLet's supply an additional check for invalid strings that are too short."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.318", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.280", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.222", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.163", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.100", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.41", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.10", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "3.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:01.503Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42236", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:36:01.503Z", "dateReserved": "2024-07-30T07:40:12.252Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-07T15:14:25.642Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/configfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a444c3fc264119801575ab086e03fb4952f23fd0", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "c95fbdde87e39e5e0ae27f28bf6711edfb985caa", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "e8474a10c535e6a2024c3b06e37e4a3a23beb490", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "2d16f63d8030903e5031853e79d731ee5d474e70", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "d1205033e912f9332c1dbefa812e6ceb0575ce0a", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "eecfefad0953b2f31aaefa058f7f348ff39c4bba", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}, {"lessThan": "6d3c721e686ea6c59e18289b400cc95c76e927e0", "status": "affected", "version": "88af8bbe4ef781031ad3370847553f3b42ba0076", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/configfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.318", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.280", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.222", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.163", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.100", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.41", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "43E390F8-BDB4-4990-B94D-095DD8369C31", "versionEndExcluding": "4.19.318", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "625DBFAB-C3D0-4309-A27F-12D6428FB38F", "versionEndExcluding": "5.4.280", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "00696AC5-EE29-437F-97F9-C4D66608B327", "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD", "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "100CDF74-4DB5-4FC6-A54B-BDBDB0C27137", "versionEndExcluding": "6.1.100", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96AC42B8-D66D-4AC5-B466-E9BA7910FA29", "versionEndExcluding": "6.6.41", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352", "versionEndExcluding": "6.9.10", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Prevent OOB read/write in usb_string_copy()\n\nUserspace provided string 's' could trivially have the length zero. Left\nunchecked this will firstly result in an OOB read in the form\n`if (str[0 - 1] == '\\n') followed closely by an OOB write in the form\n`str[0 - 1] = '\\0'`.\n\nThere is already a validating check to catch strings that are too long.\nLet's supply an additional check for invalid strings that are too short."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: configfs: Evitar lectura/escritura OOB en usb_string_copy() Las cadenas 's' proporcionadas por el espacio de usuario podr\u00edan tener trivialmente una longitud cero. Si no se marca, esto dar\u00e1 como resultado en primer lugar una lectura OOB en el formato `if (str[0 - 1] == '\\n') seguida de cerca por una escritura OOB en el formato `str[0 - 1] = '\\0' `. Ya existe una verificaci\u00f3n de validaci\u00f3n para detectar cadenas que son demasiado largas. Proporcionemos una verificaci\u00f3n adicional para cadenas no v\u00e1lidas que sean demasiado cortas."}], "id": "CVE-2024-42236", "lastModified": "2026-08-04T11:19:41.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42236", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:14:04.317460Z", "version": "2.0.3"}}]}, "published": "2024-08-07T16:15:46.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a444c3fc264119801575ab086e03fb4952f23fd0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c95fbdde87e39e5e0ae27f28bf6711edfb985caa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d1205033e912f9332c1dbefa812e6ceb0575ce0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8474a10c535e6a2024c3b06e37e4a3a23beb490"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eecfefad0953b2f31aaefa058f7f348ff39c4bba"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()", "id": "2303504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303504"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: gadget: configfs: Prevent OOB read/write in usb_string_copy()\nUserspace provided string 's' could trivially have the length zero. Left\nunchecked this will firstly result in an OOB read in the form\n`if (str[0 - 1] == '\\n') followed closely by an OOB write in the form\n`str[0 - 1] = '\\0'`.\nThere is already a validating check to catch strings that are too long.\nLet's supply an additional check for invalid strings that are too short."], "name": "CVE-2024-42236", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42236\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42236\nhttps://lore.kernel.org/linux-cve-announce/2024080740-CVE-2024-42236-365d@gregkh/T"], "threat_severity": "Low"}

{}