Linux Kernel MCT U232 USB Serial Driver Interrupt Transfer Sanity Check Vulnerability

A vulnerability in the Linux kernel's USB serial MCT U232 driver has been addressed by adding a missing sanity check for interrupt-in transfer sizes. This vulnerability could lead to the driver parsing outdated or uninitialized memory, potentially leaking sensitive information to user space. The issue was introduced in Linux version 2.6.12-rc2 and has been fixed in the stable branch.

Impact

The vulnerability could cause the driver to expose uninitialized memory to user space, leading to potential information leaks.

Reproduction

The vulnerability can be reproduced by using a version of the Linux kernel that includes the MCT U232 USB serial driver prior to the fix. When the driver receives an interrupt-in transfer, the absence of a proper sanity check allows the transfer to be processed even if it contains stale or uninitialized data. This unverified data can then be leaked to user space, demonstrating the vulnerability.

Remediation

Users can upgrade to the latest version of the Linux kernel stable branch, where this vulnerability has been fixed.