Linux Kernel usbnet ipheth DPE Length Check Overflow Vulnerability

A vulnerability in the Linux kernel's usbnet component, specifically within the ipheth driver, has been addressed. The issue involved a potential overflow in the Data Packet Exchange (DPE) length check. The original implementation could allow an overflow if the sum of the Datagram Index and Datagram Length exceeded the maximum value for a 16-bit unsigned integer. This flaw had the potential to lead to an Out-of-Bounds Read. The vulnerability has been resolved by adjusting the inequality to prevent the overflow, while an existing condition ensures that the Datagram Index remains within the bounds of the actual length of the USB request block.

Impact

Exploitation of this vulnerability could have led to an Out-of-Bounds Read, potentially allowing for memory corruption or information disclosure.