In various setup methods of the USB gadget subsystem, there is a possible
out of bounds write due to an incorrect flag check. This could lead to
local escalation of privilege with no additional execution privileges
needed. User interaction is not needed for exploitation.Product:
AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream
kernel

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux
kernel did not properly restrict the size of control requests for certain
gadget types, leading to possible out of bounds reads or writes. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code.

sbeattie

likely introduces subtle regression that needs f08adf5add9a ("USB: gadget: bRequestType is a bitfield, not a enum") to address