CVE-2024-42236

A flaw was found in the Linux kernel. When processing user-supplied strings in the USB gadget configfs interface, the usb_string_copy() function fails to validate zero-length strings. A local user can exploit this flaw by providing an empty string, triggering an out-of-bounds memory read and write. This issue may lead to a system crash, resulting in a Denial of Service (DoS), or potential memory corruption.

This vulnerability is rated as Low severity because triggering it requires local interaction with the USB gadget configfs subsystem, an uncommon setup in enterprise environments that typically requires elevated privileges. Standard Red Hat Enterprise Linux systems operate as USB hosts rather than gadget devices, and supported Red Hat Enterprise Linux releases are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.