linux-kernel - Re: [PATCH v2 1/2] usb: gadget: max3420_udc: Fix out-of-bounds endpoint index access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250713160540.125960-1-eeodqql09@gmail.com>
Date: Sun, 13 Jul 2025 12:05:40 -0400
From: pip-izony <eeodqql09@...il.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Kyungtae Kim <Kyungtae.Kim@...tmouth.edu>,
	Jassi Brar <jaswinder.singh@...aro.org>,
	Felipe Balbi <balbi@...nel.org>,
	linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH v2 1/2] usb: gadget: max3420_udc: Fix out-of-bounds endpoint index access

> Also, you sent 2 patches, with identical subject lines, but they did
> different things. That's not ok as you know.

My apologies for the mistake. I will separate them properly in the
next version of the patch series.

> And I think you really need to test this on hardware.  How could that
> request ever have a windex set to greater than 3?  Is that a hardware
> value or a user-controlled value?

The wIndex field of a SETUP packet is sent by the USB host and can
be controlled by a malicious or malformed host.
This same class of vulnerability was identified and fixed in other
UDC drivers, as described in CVE-2022-27223 and fixed in the xilinx
UDC driver by commit 7f14c7227f34 ("USB: gadget: validate endpoint 
index for xilinx udc").

Following this established pattern, I added the necessary bounds
check to the max3420_udc driver before wIndex is used to access
the endpoint array.

Thank you.

Seungjin Bae