Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk). To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before d8418fd083d1b90a6c007cf8dcf81aeae274727b; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before 60abea505b726b38232a0ef410d2bd1994a77f78; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before 2bd8534a1b83c65702aec3cab164170f8e584188; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before 9edcf317620d7c6a8354911b69b874cf89716646; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before 647d61aef106dbed9c70447bcddbd4968e67ca64; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before 37514a5c1251a8c5c95c323f55050736e7069ac7; affected 0a8fd1346254974c3a852338508e4a4cddbb35f1 before a368ecde8a5055b627749b09c6218ef793043e47; affected c3726b442527ab31c7110d0445411f5b5343db01; affected 15668b4354b38b41b316571deed2763d631b2977; affected 8597a9245181656ae2ef341906e5f40af323fbca; affected 264024a2676ba7d91fe7b1713b2c32d1b0b508cb; affected b0de742a1be16b76b534d088682f18cf57f012d2; affected 7cc00abef071a8a7d0f4457b7afa2f57f683d83f; affected 05b0f2fc3c2f9efda47439557e0d51faca7e43ed; affected 3.2.87 before 3.3; affected 3.10.106 before 3.11; affected 3.12.70 before 3.13; affected 3.16.42 before 3.17; affected 4.1.39 before 4.2; affected 4.4.42 before 4.5; affected 4.9.3 before 4.10 |
| Linux / Linux | affected 4.10; unaffected 0 before 4.10; unaffected 4.19.318 through 4.19.*; unaffected 5.4.280 through 5.4.*; unaffected 5.10.222 through 5.10.*; unaffected 5.15.163 through 5.15.*; unaffected 6.1.100 through 6.1.*; unaffected 6.6.41 through 6.6.*; unaffected 6.9.10 through 6.9.*; unaffected 6.10 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/d8418fd083d1b90a6c007cf8dcf81aeae274727b
- https://git.kernel.org/stable/c/60abea505b726b38232a0ef410d2bd1994a77f78
- https://git.kernel.org/stable/c/d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf
- https://git.kernel.org/stable/c/2bd8534a1b83c65702aec3cab164170f8e584188
- https://git.kernel.org/stable/c/9edcf317620d7c6a8354911b69b874cf89716646
- https://git.kernel.org/stable/c/647d61aef106dbed9c70447bcddbd4968e67ca64
- https://git.kernel.org/stable/c/37514a5c1251a8c5c95c323f55050736e7069ac7
- https://git.kernel.org/stable/c/a368ecde8a5055b627749b09c6218ef793043e47
ADP enrichment
No English description supplied.
- https://git.kernel.org/stable/c/d8418fd083d1b90a6c007cf8dcf81aeae274727b
- https://git.kernel.org/stable/c/60abea505b726b38232a0ef410d2bd1994a77f78
- https://git.kernel.org/stable/c/d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf
- https://git.kernel.org/stable/c/2bd8534a1b83c65702aec3cab164170f8e584188
- https://git.kernel.org/stable/c/9edcf317620d7c6a8354911b69b874cf89716646
- https://git.kernel.org/stable/c/647d61aef106dbed9c70447bcddbd4968e67ca64
- https://git.kernel.org/stable/c/37514a5c1251a8c5c95c323f55050736e7069ac7
- https://git.kernel.org/stable/c/a368ecde8a5055b627749b09c6218ef793043e47
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
No English description supplied.
No references supplied.