usb: aqc111: check packet for fixup for true limit
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 18 Sep 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:* |
Mon, 04 Nov 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 19 Sep 2024 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-467 |
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T19:31:09.197Z
Reserved: 2024-03-06T09:52:12.099Z
Link: CVE-2023-52655
Updated: 2024-08-02T23:03:21.350Z
Status : Analyzed
Published: 2024-05-14T14:23:13.467
Modified: 2025-09-18T17:08:40.777
Link: CVE-2023-52655
OpenCVE Enrichment
Updated: 2025-07-12T22:24:00Z