CVE-2024-41035: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpointisduplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk).
To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usbparseendpoint() and use the copy instead of the original when checking for duplicates.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a duplicate endpoint bug in the usbparseendpoint() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41035?
CVE-2024-41035 is categorized as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2024-41035?
To mitigate CVE-2024-41035, upgrade the kernel to a version that is 4.19.318 or newer, or follow the specific package guidelines provided by your distribution.
What impact does CVE-2024-41035 have on systems?
CVE-2024-41035 can lead to unexpected behavior in USB devices due to a bug in the USB core of the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2024-41035?
CVE-2024-41035 affects multiple versions of the Linux kernel prior to 4.19.318, 5.4.280, 5.10.222, 5.15.163, 6.1.100, and others as specified in the remediation guidelines.
Is CVE-2024-41035 a critical vulnerability?
No, CVE-2024-41035 is not classified as a critical vulnerability, but it should still be addressed to ensure stable system operation.