5.5

CVE-2024-44960

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: core: Check for unset descriptor

Make sure the descriptor has been set before looking at maxpacket.
This fixes a null pointer panic in this case.

This may happen if the gadget doesn't properly set up the endpoint
for the current speed, or the gadget descriptors are malformed and
the descriptor for the speed/endpoint are not found.

No current gadget driver is known to have this problem, but this
may cause a hard-to-find bug during development of new gadgets.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 3.16.80
Linux ≫ Linux Kernel Version >= 3.17 < 4.4.199
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.199
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.152
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.320
Linux ≫ Linux Kernel Version >= 4.20 < 5.3.9
Linux ≫ Linux Kernel Version >= 5.4 < 5.4.282
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.224
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.165
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.105
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.46
Linux ≫ Linux Kernel Version >= 6.7 < 6.10.5
Linux ≫ Linux Kernel Version6.11 Updaterc1
Linux ≫ Linux Kernel Version6.11 Updaterc2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.05
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.