In the Linux kernel, the following vulnerability has been resolved:
usb: aqc111: check packet for fixup for true limit
If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value.
The driver will then proceed to parse the header located at that position, which will either oops or process some random value.
The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver.
[
{
"id": "CVE-2023-52655-0462fcfa",
"signature_type": "Function",
"digest": {
"length": 1686.0,
"function_hash": "259502968371364979099142503966240000156"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c386d73689a45d5ee8c1290827bce64056dddd",
"target": {
"function": "aqc111_rx_fixup",
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-054dcc0a",
"signature_type": "Line",
"digest": {
"line_hashes": [
"106164755847542329171127678027903074375",
"107123208618357413787663292980526099459",
"111699532752223055586837841727999380677",
"216172799903764209513004847345209546098",
"73994781545982983073621157776624580174",
"257484953906958560059398591285377065899",
"46509854043281686640951245668112689664",
"212767354345995062353854464628953709762",
"319589769178092389795051242164243425345",
"149465886198902187396433181289117183626"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ebf775f0541ae0d474836fa0cf3220e502f8e3e",
"target": {
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-062997a8",
"signature_type": "Line",
"digest": {
"line_hashes": [
"106164755847542329171127678027903074375",
"107123208618357413787663292980526099459",
"111699532752223055586837841727999380677",
"216172799903764209513004847345209546098",
"73994781545982983073621157776624580174",
"257484953906958560059398591285377065899",
"46509854043281686640951245668112689664",
"212767354345995062353854464628953709762",
"319589769178092389795051242164243425345",
"149465886198902187396433181289117183626"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccab434e674ca95d483788b1895a70c21b7f016a",
"target": {
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-0b3f8be9",
"signature_type": "Line",
"digest": {
"line_hashes": [
"106164755847542329171127678027903074375",
"107123208618357413787663292980526099459",
"111699532752223055586837841727999380677",
"216172799903764209513004847345209546098",
"73994781545982983073621157776624580174",
"257484953906958560059398591285377065899",
"46509854043281686640951245668112689664",
"212767354345995062353854464628953709762",
"319589769178092389795051242164243425345",
"149465886198902187396433181289117183626"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46412b2fb1f9cc895d6d4036bf24f640b5d86dab",
"target": {
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-164e91d9",
"signature_type": "Line",
"digest": {
"line_hashes": [
"106164755847542329171127678027903074375",
"107123208618357413787663292980526099459",
"111699532752223055586837841727999380677",
"216172799903764209513004847345209546098",
"73994781545982983073621157776624580174",
"257484953906958560059398591285377065899",
"46509854043281686640951245668112689664",
"212767354345995062353854464628953709762",
"319589769178092389795051242164243425345",
"149465886198902187396433181289117183626"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69581c17608d81824dd497d9a54b6a5b6139975",
"target": {
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-2d698aa1",
"signature_type": "Function",
"digest": {
"length": 1686.0,
"function_hash": "259502968371364979099142503966240000156"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69581c17608d81824dd497d9a54b6a5b6139975",
"target": {
"function": "aqc111_rx_fixup",
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-3c3324e8",
"signature_type": "Function",
"digest": {
"length": 1686.0,
"function_hash": "259502968371364979099142503966240000156"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46412b2fb1f9cc895d6d4036bf24f640b5d86dab",
"target": {
"function": "aqc111_rx_fixup",
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-6064b22b",
"signature_type": "Function",
"digest": {
"length": 1686.0,
"function_hash": "259502968371364979099142503966240000156"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ebf775f0541ae0d474836fa0cf3220e502f8e3e",
"target": {
"function": "aqc111_rx_fixup",
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-6c5a9265",
"signature_type": "Line",
"digest": {
"line_hashes": [
"106164755847542329171127678027903074375",
"107123208618357413787663292980526099459",
"111699532752223055586837841727999380677",
"216172799903764209513004847345209546098",
"73994781545982983073621157776624580174",
"257484953906958560059398591285377065899",
"46509854043281686640951245668112689664",
"212767354345995062353854464628953709762",
"319589769178092389795051242164243425345",
"149465886198902187396433181289117183626"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c386d73689a45d5ee8c1290827bce64056dddd",
"target": {
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-b9fe522e",
"signature_type": "Function",
"digest": {
"length": 1686.0,
"function_hash": "259502968371364979099142503966240000156"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84f2e5b3e70f08fce3cb1ff73414631c5e490204",
"target": {
"function": "aqc111_rx_fixup",
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-d23c46ca",
"signature_type": "Function",
"digest": {
"length": 1686.0,
"function_hash": "259502968371364979099142503966240000156"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccab434e674ca95d483788b1895a70c21b7f016a",
"target": {
"function": "aqc111_rx_fixup",
"file": "drivers/net/usb/aqc111.c"
}
},
{
"id": "CVE-2023-52655-fb1e9e9a",
"signature_type": "Line",
"digest": {
"line_hashes": [
"106164755847542329171127678027903074375",
"107123208618357413787663292980526099459",
"111699532752223055586837841727999380677",
"216172799903764209513004847345209546098",
"73994781545982983073621157776624580174",
"257484953906958560059398591285377065899",
"46509854043281686640951245668112689664",
"212767354345995062353854464628953709762",
"319589769178092389795051242164243425345",
"149465886198902187396433181289117183626"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84f2e5b3e70f08fce3cb1ff73414631c5e490204",
"target": {
"file": "drivers/net/usb/aqc111.c"
}
}
]