CVE-2022-50876

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: Fix musb_gadget.c rxstate overflow bug

The usb function device call musb_gadget_queue() adds the passed

request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz)

and (is_buffer_mapped(req) return false),the rxstate() will copy all data

in fifo to request->buf which may cause request->buf out of bounds.

Fix it by add the length check :

fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References