A bug exists in drivers/usb/serial/whiteheat.c that can result in a kernel memory corruption. The WHITEHEAT_GET_DTR_RTS command response is not verified correctly in the function command_port_read_callback. It assumes that the bulk response cannot be larger than 64 bytes, however on EHCI and XHCI this isn't necessarily the case.
We consider this a security bug in the context of an attacker who gains short-term physical access to a running device with the goal of turning this into long-term remote access.
I've attached a non-tested patch that attempts to address the issue by not handling responses greater than the buffer size.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
Status: Fixed