CVE-2024-42236

What it actually does

Missing length validation for zero-length userspace strings in usb_string_copy() allows out-of-bounds read at str[-1] followed by out-of-bounds write of a null byte at the same location, classified as memory corruption.

Why it matters to the business

Local denial-of-service risk on Linux systems using USB gadget/configfs interfaces can interrupt storage, networking, or device functionality; widespread kernel exposure increases patching urgency across servers, embedded devices, and distributions despite low exploit probability.

How an attack unfolds

An attacker with local access supplies a zero-length string through configfs USB gadget interfaces; the unchecked length triggers the existing negative-index access pattern, causing memory corruption that may lead to crashes or limited write primitives.

How to fix it

Update the Linux kernel to commit a444c3fc264119801575ab086e03fb4952f23fd0 or later; for AlmaLinux 8 packages apply iscsi-initiator-utils 6.2.1.4-4.git095f59c.el8 or newer; rebuild and reboot systems using affected kernel versions.

How to confirm the fix worked

Verify kernel version or package version matches the fixed releases; attempt to write a zero-length string through configfs USB gadget attributes and confirm no crash or corruption occurs; review kernel source for the added length-zero check in usb_string_copy().

Typical attack path

1. Obtain local access or user context on a Linux system exposing USB gadget configfs
2. Write a zero-length string value to a usb string attribute via configfs
3. Trigger the usb_string_copy() path that performs the unchecked str[-1] operations
4. Observe resulting kernel oops, panic, or memory corruption effects

How to detect it

Search kernel logs for oops or panic messages referencing usb_string_copy or configfs string handling; review audit logs for unusual writes to configfs USB gadget string attributes; correlate with local user activity around gadget configuration changes.

What your security team should do

• Prioritize kernel and iscsi-initiator-utils updates on all affected AlmaLinux 8 and upstream Linux systems within standard change windows
• Inventory systems exposing USB gadget or configfs interfaces and schedule reboots after patching
• Monitor vendor advisories for backports to older stable kernels still in use