usb: gadget: f_midi: fix MIDI Streaming descriptor lengths (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.23 % · centile 14 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, bNumEmbMIDIJack and bLength are set incorrectly in these descriptors. This does not matter when the numbers of in and out ports are equal, but when they differ the host will receive broken descriptors with uninitialized stack memory leaking into the descriptor for whichever value is smaller. The precise meaning of "in" and "out" in the port counts is not clearly defined and can be confusing. But elsewhere the driver consistently uses this to match the USB meaning of IN and OUT viewed from the host, so that "in" ports send data to the host and "out" ports receive data from it.
Références
- https://git.kernel.org/stable/c/3a983390d14e8498f303fc5cb23ab7d696b815db
- https://git.kernel.org/stable/c/9f36a89dcb78cb7e37f487b04a16396ac18c0636
- https://git.kernel.org/stable/c/d8e86700c8a8cf415e300a0921acd6a8f9b494f8
- https://git.kernel.org/stable/c/9f6860a9c11301b052225ca8825f8d2b1a5825bf
- https://git.kernel.org/stable/c/6ae6dee9f005a2f3b739b85abb6f14a0935699e0
- https://git.kernel.org/stable/c/6b16761a928796e4b49e89a0b1ac284155172726
- https://git.kernel.org/stable/c/a2d0694e1f111379c1efdf439dadd3cfd959fe9d
- https://git.kernel.org/stable/c/da1668997052ed1cb00322e1f3b63702615c9429
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-6298
- GCVE · GCVE-0-2025-21835
Avis du CERT-FR
- CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0758 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0743 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0721 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0605 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0559 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0509 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0463 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0307 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0277 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.2 < 5.4.291cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.235cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.179cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.129cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.79cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.13.4cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected c8933c3f79568263c90a46f06cf80419e6c63c97 < 3a983390d14e8498f303fc5cb23ab7d696b815db ; affected c8933c3f79568263c90a46f06cf80419e6c63c97 < 9f36a89dcb78cb7e37f487b04a16396ac18c0636 ; affected c8933c3f79568263c90a46f06cf80419e6c63c97 < d8e86700c8a8cf415e300a0921acd6a8f9b494f8 ; affected c8933c3f79568263c90a46f06cf80419e6c63c97 < 9f6860a9c11301b052225ca8825f8d2b1a5825bf ; affected c8933c3f79568263c90a46f06cf80419e6c63c97 < 6ae6dee9f005a2f3b739b85abb6f14a0935699e0 ; affected c8933c3f79568263c90a46f06cf80419e6c63c97 < 6b16761a928796e4b49e89a0b1ac284155172726 |
| Linux · Linux | affected 3.2 ; unaffected 0 < 3.2 ; unaffected 5.4.291 ≤ 5.4.* ; unaffected 5.10.235 ≤ 5.10.* ; unaffected 5.15.179 ≤ 5.15.* ; unaffected 6.1.129 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |