| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-41035: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor |
| |
| Syzbot has identified a bug in usbcore (see the Closes: tag below) |
| caused by our assumption that the reserved bits in an endpoint |
| descriptor's bEndpointAddress field will always be 0. As a result of |
| the bug, the endpoint_is_duplicate() routine in config.c (and possibly |
| other routines as well) may believe that two descriptors are for |
| distinct endpoints, even though they have the same direction and |
| endpoint number. This can lead to confusion, including the bug |
| identified by syzbot (two descriptors with matching endpoint numbers |
| and directions, where one was interrupt and the other was bulk). |
| |
| To fix the bug, we will clear the reserved bits in bEndpointAddress |
| when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 |
| specs say these bits are "Reserved, reset to zero".) This requires us |
| to make a copy of the descriptor earlier in usb_parse_endpoint() and |
| use the copy instead of the original when checking for duplicates. |
| |
| The Linux kernel CVE team has assigned CVE-2024-41035 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 4.19.318 with commit d8418fd083d1b90a6c007cf8dcf81aeae274727b |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 5.4.280 with commit 60abea505b726b38232a0ef410d2bd1994a77f78 |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 5.10.222 with commit d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 5.15.163 with commit 2bd8534a1b83c65702aec3cab164170f8e584188 |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 6.1.100 with commit 9edcf317620d7c6a8354911b69b874cf89716646 |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 6.6.41 with commit 647d61aef106dbed9c70447bcddbd4968e67ca64 |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 6.9.10 with commit 37514a5c1251a8c5c95c323f55050736e7069ac7 |
| Issue introduced in 4.10 with commit 0a8fd1346254974c3a852338508e4a4cddbb35f1 and fixed in 6.10 with commit a368ecde8a5055b627749b09c6218ef793043e47 |
| Issue introduced in 3.2.87 with commit c3726b442527ab31c7110d0445411f5b5343db01 |
| Issue introduced in 3.10.106 with commit 15668b4354b38b41b316571deed2763d631b2977 |
| Issue introduced in 3.12.70 with commit 8597a9245181656ae2ef341906e5f40af323fbca |
| Issue introduced in 3.16.42 with commit 264024a2676ba7d91fe7b1713b2c32d1b0b508cb |
| Issue introduced in 4.1.39 with commit b0de742a1be16b76b534d088682f18cf57f012d2 |
| Issue introduced in 4.4.42 with commit 7cc00abef071a8a7d0f4457b7afa2f57f683d83f |
| Issue introduced in 4.9.3 with commit 05b0f2fc3c2f9efda47439557e0d51faca7e43ed |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-41035 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/usb/core/config.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d8418fd083d1b90a6c007cf8dcf81aeae274727b |
| https://git.kernel.org/stable/c/60abea505b726b38232a0ef410d2bd1994a77f78 |
| https://git.kernel.org/stable/c/d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf |
| https://git.kernel.org/stable/c/2bd8534a1b83c65702aec3cab164170f8e584188 |
| https://git.kernel.org/stable/c/9edcf317620d7c6a8354911b69b874cf89716646 |
| https://git.kernel.org/stable/c/647d61aef106dbed9c70447bcddbd4968e67ca64 |
| https://git.kernel.org/stable/c/37514a5c1251a8c5c95c323f55050736e7069ac7 |
| https://git.kernel.org/stable/c/a368ecde8a5055b627749b09c6218ef793043e47 |
