Linux Kernel gs_usb Error Handling Improvement Vulnerability

A vulnerability in the Linux kernel's gs_usb CAN driver has been addressed. The issue arose in the 'gs_usb_receive_bulk_callback' function, where a short read could lead to dereferencing a null value if the netdev had not been assigned. The vulnerability has been fixed by initializing the netdev as NULL in such cases, preventing the undefined value dereference. Additionally, the error value from failed USB request block (URB) resubmissions is now reported, enhancing the error handling of the function.

Impact

The vulnerability could lead to a null pointer dereference, causing a crash or undefined behavior in the kernel.

Reproduction

The vulnerability can be reproduced by triggering a short read in the gs_usb CAN driver before the netdev is assigned. This will cause the driver to dereference a null value, leading to a crash or undefined behavior.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.