CVE-2022-48834

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Fix bug in pipe direction for control transfers The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline] The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e	Patch
https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952	Patch
https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016	Patch
https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7	Patch
https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b	Patch
https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e	Patch
https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952	Patch
https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016	Patch
https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7	Patch
https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

21 Nov 2024, 07:34

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e - Patch~~	() https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e - Patch
References	~~() https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952 - Patch~~	() https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952 - Patch
References	~~() https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016 - Patch~~	() https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016 - Patch
References	~~() https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7 - Patch~~	() https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7 - Patch
References	~~() https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b - Patch~~	() https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b - Patch

19 Jul 2024, 18:00

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
First Time		Linux Linux linux Kernel
References	~~() https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e -~~	() https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e - Patch
References	~~() https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952 -~~	() https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952 - Patch
References	~~() https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016 -~~	() https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016 - Patch
References	~~() https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7 -~~	() https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7 - Patch
References	~~() https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b -~~	() https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b - Patch
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:o:linux:linux_kernel::::::::
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: usbtmc: corrige un error en la dirección de la tubería para las transferencias de control. El syzbot fuzzer informó un error menor en el controlador usbtmc: usb 5-1: directorio de control BOGUS, la tubería 80001e80 no coincide con bRequestType 0 ADVERTENCIA: CPU: 0 PID: 3813 en drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Módulos vinculados en: CPU: 0 PID: 3813 Comm : syz-executor122 No contaminado 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Seguimiento de llamadas: usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core /message.c:102 [en línea] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [en línea] El problema es que usbtmc_ioctl_request() usa usb_rcvctrlpipe( ) para todas sus transferencias, ya sean de entrada o de salida. Es fácil de arreglar.

16 Jul 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-16 13:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48834

Mitre link : CVE-2022-48834

CVE.ORG link : CVE-2022-48834

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

7.8 /10