Linux Kernel DWC3 Gadget Event Buffer Out-of-Bounds Access Vulnerability

A vulnerability in the Linux kernel's DWC3 USB gadget driver allows for out-of-bounds memory access. The issue arises because the event count, read from the DWC3_GEVNTCOUNT register, is not properly validated against the event buffer length. This oversight can lead to memory corruption when the event count exceeds the buffer length, causing a kernel crash. The vulnerability has been addressed by implementing a check to ensure the event count does not surpass the event buffer length, thereby preventing the out-of-bounds access during memory copy operations.

Impact

Exploitation of this vulnerability can lead to a kernel crash, indicating a denial-of-service condition.