CVE-2020-13143: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-13143 was discovered in the Linux kernel versions 3.16 through 5.6.13. The vulnerability exists in the gadget_dev_desc_UDC_store function in drivers/usb/gadget/configfs.c, where it relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read (NVD, Linux Kernel).

The vulnerability occurs when the size of the 'name' buffer is smaller than that of the 'page' buffer after kstrdup execution. This happens because the 'page' buffer contains a null (\0) value in the middle, causing kstrdup to create a smaller buffer than expected. When accessing the 'name' buffer with the 'len' variable (which indicates the size of the 'page' buffer), it triggers a memory access violation (Linux USB).

A local attacker with permissions to write to the gadget configuration filesystem could exploit this vulnerability to cause a denial of service (system crash or memory corruption) or potentially achieve privilege escalation (Ubuntu Security).

The vulnerability requires local access and permissions to write to the gadget configuration filesystem. It has been confirmed to be exploitable through specially crafted input that contains null bytes, as demonstrated by the FuzzUSB testing tool (Linux USB).

The vulnerability was fixed in Linux kernel version 5.6.14 by adding a check to compare strlen() of the original buffer with the size variable, ensuring no zero value exists in the buffer before accessing the kstrdup-ed buffer (Linux Kernel). Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu and Debian (Ubuntu Security, Debian Security).