Linux Kernel usbnet Out-of-Bounds Read Vulnerability in ipheth Driver

A vulnerability allowing an out-of-bounds read has been identified in the Linux kernel's usbnet component, specifically within the ipheth driver. The issue arises because the NDP16 header's starting position could be manipulated to extend beyond the intended bounds of the URB, based on the wNdpIndex value in NTH16. This flaw was not fully addressed by a recent commit, which only partially corrected the out-of-bounds read by enforcing a specific NDP16 format and checking URB length. The vulnerability persists because the limit on the number of DPEs has not been separately enforced.

Impact

Exploitation of this vulnerability leads to an out-of-bounds read, which can potentially be exploited to read memory locations outside the intended buffer, causing undefined behavior or information disclosure.