Linux Kernel FunctionFS USB Gadget Short Control OUT Buffer Vulnerability

A vulnerability in the Linux kernel's FunctionFS USB gadget implementation allows uninitialized memory to be sent to userspace. This issue arises because the control-OUT data buffer is allocated with kmalloc() using the length specified in the Setup packet. The function then copies the entire length to userspace, regardless of the actual bytes received. As a result, any uninitialized slab residue from the buffer is delivered to the FunctionFS daemon. This vulnerability is present in the Linux kernel stable tree and affects several versions.

Impact

Exploitation of this vulnerability leads to the unintentional exposure of uninitialized memory to the FunctionFS daemon, which could potentially be manipulated or misused.

Reproduction

The vulnerability can be reproduced by sending a short control OUT transfer through the FunctionFS device node. This can be done by bypassing the host-side checks that normally reject short transfers. Once the transfer is sent, the uninitialized memory can be observed in the daemon's read buffer.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.