cve/rejected/2024/CVE-2024-56571.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-56571: media: uvcvideo: Require entities to have a non-zero unique ID

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 media: uvcvideo: Require entities to have a non-zero unique ID

 Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
 unique ID.

 ```
 Each Unit and Terminal within the video function is assigned a unique
 identification number, the Unit ID (UID) or Terminal ID (TID), contained in
 the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
 reserved for undefined ID,
 ```

 So, deny allocating an entity with ID 0 or an ID that belongs to a unit
 that is already added to the list of entities.

 This also prevents some syzkaller reproducers from triggering warnings due
 to a chain of entities referring to themselves. In one particular case, an
 Output Unit is connected to an Input Unit, both with the same ID of 1. But
 when looking up for the source ID of the Output Unit, that same entity is
 found instead of the input entity, which leads to such warnings.

 In another case, a backward chain was considered finished as the source ID
 was 0. Later on, that entity was found, but its pads were not valid.

 Here is a sample stack trace for one of those cases.

 [   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
 [   20.830206] usb 1-1: Using ep0 maxpacket: 8
 [   20.833501] usb 1-1: config 0 descriptor??
 [   21.038518] usb 1-1: string descriptor 0 read error: -71
 [   21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
 [   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
 [   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
 [   21.042218] ------------[ cut here ]------------
 [   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
 [   21.043195] Modules linked in:
 [   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
 [   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
 [   21.044639] Workqueue: usb_hub_wq hub_event
 [   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
 [   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
 [   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
 [   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
 [   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
 [   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
 [   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
 [   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
 [   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
 [   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 [   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
 [   21.051136] PKRU: 55555554
 [   21.051331] Call Trace:
 [   21.051480]  <TASK>
 [   21.051611]  ? __warn+0xc4/0x210
 [   21.051861]  ? media_create_pad_link+0x2c4/0x2e0
 [   21.052252]  ? report_bug+0x11b/0x1a0
 [   21.052540]  ? trace_hardirqs_on+0x31/0x40
 [   21.052901]  ? handle_bug+0x3d/0x70
 [   21.053197]  ? exc_invalid_op+0x1a/0x50
 [   21.053511]  ? asm_exc_invalid_op+0x1a/0x20
 [   21.053924]  ? media_create_pad_link+0x91/0x2e0
 [   21.054364]  ? media_create_pad_link+0x2c4/0x2e0
 [   21.054834]  ? media_create_pad_link+0x91/0x2e0
 [   21.055131]  ? _raw_spin_unlock+0x1e/0x40
 [   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210
 [   21.055837]  uvc_mc_register_entities+0x358/0x400
 [   21.056144]  uvc_register_chains+0x1fd/0x290
 [   21.056413]  uvc_probe+0x380e/0x3dc0
 [   21.056676]  ? __lock_acquire+0x5aa/0x26e0
 [   21.056946]  ? find_held_lock+0x33/0xa0
 [   21.057196]  ? kernfs_activate+0x70/0x80
 [   21.057533]  ? usb_match_dynamic_id+0x1b/0x70
 [   21.057811]  ? find_held_lock+0x33/0xa0
 [   21.058047]  ? usb_match_dynamic_id+0x55/0x70
 [   21.058330]  ? lock_release+0x124/0x260
 [   21.058657]  ? usb_match_one_id_intf+0xa2/0x100
 [   21.058997]  usb_probe_interface+0x1ba/0x330
 [   21.059399]  really_probe+0x1ba/0x4c0
 [   21.059662]  __driver_probe_device+0xb2/0x180
 [   21.059944]  driver_probe_device+0x5a/0x100
 [   21.060170]  __device_attach_driver+0xe9/0x160
 [   21.060427]  ? __pfx___device_attach_driver+0x10/0x10
 [   21.060872]  bus_for_each_drv+0xa9/0x100
 [   21.061312]  __device_attach+0xed/0x190
 [   21.061812]  device_initial_probe+0xe/0x20
 [   21.062229]  bus_probe_device+0x4d/0xd0
 [   21.062590]  device_add+0x308/0x590
 [   21.062912]  usb_set_configuration+0x7b6/0xaf0
 [   21.063403]  usb_generic_driver_probe+0x36/0x80
 [   21.063714]  usb_probe_device+0x7b/0x130
 [   21.063936]  really_probe+0x1ba/0x4c0
 [   21.064111]  __driver_probe_device+0xb2/0x180
 [   21.064577]  driver_probe_device+0x5a/0x100
 [   21.065019]  __device_attach_driver+0xe9/0x160
 [   21.065403]  ? __pfx___device_attach_driver+0x10/0x10
 [   21.065820]  bus_for_each_drv+0xa9/0x100
 [   21.066094]  __device_attach+0xed/0x190
 [   21.066535]  device_initial_probe+0xe/0x20
 [   21.066992]  bus_probe_device+0x4d/0xd0
 [   21.067250]  device_add+0x308/0x590
 [   21.067501]  usb_new_device+0x347/0x610
 [   21.067817]  hub_event+0x156b/0x1e30
 [   21.068060]  ? process_scheduled_works+0x48b/0xaf0
 [   21.068337]  process_scheduled_works+0x5a3/0xaf0
 [   21.068668]  worker_thread+0x3cf/0x560
 [   21.068932]  ? kthread+0x109/0x1b0
 [   21.069133]  kthread+0x197/0x1b0
 [   21.069343]  ? __pfx_worker_thread+0x10/0x10
 [   21.069598]  ? __pfx_kthread+0x10/0x10
 [   21.069908]  ret_from_fork+0x32/0x40
 [   21.070169]  ? __pfx_kthread+0x10/0x10
 [   21.070424]  ret_from_fork_asm+0x1a/0x30
 [   21.070737]  </TASK>

 The Linux kernel CVE team has assigned CVE-2024-56571 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 5.10.231 with commit bde4e7c1527151b596089b3f984818ab537eeb7f
 	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 5.15.174 with commit 72ed66623953106d15825513c82533a03ba29ecd
 	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.1.120 with commit 19464d73225224dca31e2fd6e7d6418facf5facb
 	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.6.64 with commit b11813bc2f4eee92695075148c9ba996f54feeba
 	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.12.4 with commit 4f74bd307f078c0605b9f6f1edb8337dee35fa2e
 	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.13 with commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-56571
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/media/usb/uvc/uvc_driver.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/bde4e7c1527151b596089b3f984818ab537eeb7f
 	https://git.kernel.org/stable/c/72ed66623953106d15825513c82533a03ba29ecd
 	https://git.kernel.org/stable/c/19464d73225224dca31e2fd6e7d6418facf5facb
 	https://git.kernel.org/stable/c/b11813bc2f4eee92695075148c9ba996f54feeba
 	https://git.kernel.org/stable/c/4f74bd307f078c0605b9f6f1edb8337dee35fa2e
 	https://git.kernel.org/stable/c/3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-56571: media: uvcvideo: Require entities to have a non-zero unique ID

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	media: uvcvideo: Require entities to have a non-zero unique ID

	Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
	unique ID.

	```
	Each Unit and Terminal within the video function is assigned a unique
	identification number, the Unit ID (UID) or Terminal ID (TID), contained in
	the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
	reserved for undefined ID,
	```

	So, deny allocating an entity with ID 0 or an ID that belongs to a unit
	that is already added to the list of entities.

	This also prevents some syzkaller reproducers from triggering warnings due
	to a chain of entities referring to themselves. In one particular case, an
	Output Unit is connected to an Input Unit, both with the same ID of 1. But
	when looking up for the source ID of the Output Unit, that same entity is
	found instead of the input entity, which leads to such warnings.

	In another case, a backward chain was considered finished as the source ID
	was 0. Later on, that entity was found, but its pads were not valid.

	Here is a sample stack trace for one of those cases.

	[ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
	[ 20.830206] usb 1-1: Using ep0 maxpacket: 8
	[ 20.833501] usb 1-1: config 0 descriptor??
	[ 21.038518] usb 1-1: string descriptor 0 read error: -71
	[ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
	[ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
	[ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
	[ 21.042218] ------------[ cut here ]------------
	[ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
	[ 21.043195] Modules linked in:
	[ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
	[ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
	[ 21.044639] Workqueue: usb_hub_wq hub_event
	[ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
	[ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
	[ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
	[ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
	[ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
	[ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
	[ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
	[ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
	[ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
	[ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	[ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
	[ 21.051136] PKRU: 55555554
	[ 21.051331] Call Trace:
	[ 21.051480] <TASK>
	[ 21.051611] ? __warn+0xc4/0x210
	[ 21.051861] ? media_create_pad_link+0x2c4/0x2e0
	[ 21.052252] ? report_bug+0x11b/0x1a0
	[ 21.052540] ? trace_hardirqs_on+0x31/0x40
	[ 21.052901] ? handle_bug+0x3d/0x70
	[ 21.053197] ? exc_invalid_op+0x1a/0x50
	[ 21.053511] ? asm_exc_invalid_op+0x1a/0x20
	[ 21.053924] ? media_create_pad_link+0x91/0x2e0
	[ 21.054364] ? media_create_pad_link+0x2c4/0x2e0
	[ 21.054834] ? media_create_pad_link+0x91/0x2e0
	[ 21.055131] ? _raw_spin_unlock+0x1e/0x40
	[ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210
	[ 21.055837] uvc_mc_register_entities+0x358/0x400
	[ 21.056144] uvc_register_chains+0x1fd/0x290
	[ 21.056413] uvc_probe+0x380e/0x3dc0
	[ 21.056676] ? __lock_acquire+0x5aa/0x26e0
	[ 21.056946] ? find_held_lock+0x33/0xa0
	[ 21.057196] ? kernfs_activate+0x70/0x80
	[ 21.057533] ? usb_match_dynamic_id+0x1b/0x70
	[ 21.057811] ? find_held_lock+0x33/0xa0
	[ 21.058047] ? usb_match_dynamic_id+0x55/0x70
	[ 21.058330] ? lock_release+0x124/0x260
	[ 21.058657] ? usb_match_one_id_intf+0xa2/0x100
	[ 21.058997] usb_probe_interface+0x1ba/0x330
	[ 21.059399] really_probe+0x1ba/0x4c0
	[ 21.059662] __driver_probe_device+0xb2/0x180
	[ 21.059944] driver_probe_device+0x5a/0x100
	[ 21.060170] __device_attach_driver+0xe9/0x160
	[ 21.060427] ? __pfx___device_attach_driver+0x10/0x10
	[ 21.060872] bus_for_each_drv+0xa9/0x100
	[ 21.061312] __device_attach+0xed/0x190
	[ 21.061812] device_initial_probe+0xe/0x20
	[ 21.062229] bus_probe_device+0x4d/0xd0
	[ 21.062590] device_add+0x308/0x590
	[ 21.062912] usb_set_configuration+0x7b6/0xaf0
	[ 21.063403] usb_generic_driver_probe+0x36/0x80
	[ 21.063714] usb_probe_device+0x7b/0x130
	[ 21.063936] really_probe+0x1ba/0x4c0
	[ 21.064111] __driver_probe_device+0xb2/0x180
	[ 21.064577] driver_probe_device+0x5a/0x100
	[ 21.065019] __device_attach_driver+0xe9/0x160
	[ 21.065403] ? __pfx___device_attach_driver+0x10/0x10
	[ 21.065820] bus_for_each_drv+0xa9/0x100
	[ 21.066094] __device_attach+0xed/0x190
	[ 21.066535] device_initial_probe+0xe/0x20
	[ 21.066992] bus_probe_device+0x4d/0xd0
	[ 21.067250] device_add+0x308/0x590
	[ 21.067501] usb_new_device+0x347/0x610
	[ 21.067817] hub_event+0x156b/0x1e30
	[ 21.068060] ? process_scheduled_works+0x48b/0xaf0
	[ 21.068337] process_scheduled_works+0x5a3/0xaf0
	[ 21.068668] worker_thread+0x3cf/0x560
	[ 21.068932] ? kthread+0x109/0x1b0
	[ 21.069133] kthread+0x197/0x1b0
	[ 21.069343] ? __pfx_worker_thread+0x10/0x10
	[ 21.069598] ? __pfx_kthread+0x10/0x10
	[ 21.069908] ret_from_fork+0x32/0x40
	[ 21.070169] ? __pfx_kthread+0x10/0x10
	[ 21.070424] ret_from_fork_asm+0x1a/0x30
	[ 21.070737] </TASK>

	The Linux kernel CVE team has assigned CVE-2024-56571 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 5.10.231 with commit bde4e7c1527151b596089b3f984818ab537eeb7f
	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 5.15.174 with commit 72ed66623953106d15825513c82533a03ba29ecd
	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.1.120 with commit 19464d73225224dca31e2fd6e7d6418facf5facb
	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.6.64 with commit b11813bc2f4eee92695075148c9ba996f54feeba
	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.12.4 with commit 4f74bd307f078c0605b9f6f1edb8337dee35fa2e
	Issue introduced in 5.7 with commit a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b and fixed in 6.13 with commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56571
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/media/usb/uvc/uvc_driver.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/bde4e7c1527151b596089b3f984818ab537eeb7f
	https://git.kernel.org/stable/c/72ed66623953106d15825513c82533a03ba29ecd
	https://git.kernel.org/stable/c/19464d73225224dca31e2fd6e7d6418facf5facb
	https://git.kernel.org/stable/c/b11813bc2f4eee92695075148c9ba996f54feeba
	https://git.kernel.org/stable/c/4f74bd307f078c0605b9f6f1edb8337dee35fa2e
	https://git.kernel.org/stable/c/3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195