CVE-2024-42236

Summary

CVE-2024-42236 is a Linux kernel vulnerability affecting the USB gadget configfs. The issue arises when the length of a userspace provided string 's' is zero, leading to out-of-bounds (OOB) read and write operations. Specifically, an OOB read can occur through the check `if (str[0 - 1] == '\\n')`, followed by an OOB write with the assignment `str[0 - 1] = '\\0'`. To mitigate this, an additional check for invalid strings that are too short is recommended.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.