NetSight
IP …
medium4.6

CVE-2022-25258

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10.

Impact

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 5.16.10
FedoraprojectFedora
Version 35
DebianDebian Linux
Versions 9.0, 10.0, 11.0
NetappActive Iq Unified Manager
All versions
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH410s Firmware
All versions
NetappH410c Firmware
All versions

Weakness classification

CWE-476

References