CVE-2022-49151

published 2025-02-26

CVE-2022-49151: In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: properly check endpoint type Syzbot reported warning in usb_submit_urb()…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: properly check endpoint type

Syzbot reported warning in usb_submit_urb() which is caused by wrong
endpoint type. We should check that in endpoint is actually present to
prevent this warning.

Found pipes are now saved to struct mcba_priv and code uses them
directly instead of making pipes in place.

Fail log:

| usb 5-1: BOGUS urb xfer, pipe 3 != type 1
| WARNING: CPU: 1 PID: 49 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
| Modules linked in:
| CPU: 1 PID: 49 Comm: kworker/1:2 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0
| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
| Workqueue: usb_hub_wq hub_event
| RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
| ...
| Call Trace:
|
| mcba_usb_start drivers/net/can/usb/mcba_usb.c:662 [inline]
| mcba_usb_probe+0x8a3/0xc50 drivers/net/can/usb/mcba_usb.c:858
| usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
| call_driver_probe drivers/base/dd.c:517 [inline]

Affected

21 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.17.3-1 (bookworm)	linux 5.17.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < 5598442edc29e8f6f2380e4b471dc1a3fcd80508	5598442edc29e8f6f2380e4b471dc1a3fcd80508
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < b48d1bb3f1ca337ad653022aefb5a40a47dfe5cd	b48d1bb3f1ca337ad653022aefb5a40a47dfe5cd
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < cbd110b8dd7ad763bf413f71c0484116ae9302d4	cbd110b8dd7ad763bf413f71c0484116ae9302d4
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < ef0acc514123140157b19a9ff2e2de5d91d612bc	ef0acc514123140157b19a9ff2e2de5d91d612bc
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < fa9c1f14002dc0d5293e16a2007bd89b6e79207b	fa9c1f14002dc0d5293e16a2007bd89b6e79207b
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < 88272b4a37913bdf6f339162a7920bd8e9b49de2	88272b4a37913bdf6f339162a7920bd8e9b49de2
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < f2ec3cd0f34f8c3f94bc21fbba14868301c9c49d	f2ec3cd0f34f8c3f94bc21fbba14868301c9c49d
linux	linux	>= 51f3baad7de943780ce0c17bd7975df567dd6e14 < 136bed0bfd3bc9c95c88aafff2d22ecb3a919f23	136bed0bfd3bc9c95c88aafff2d22ecb3a919f23
linux	linux_kernel	>= 0 < 5.10.113-1	5.10.113-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 4.12 < 4.14.276	4.14.276
linux	linux_kernel	>= 4.15 < 4.19.238	4.19.238
linux	linux_kernel	>= 4.20 < 5.4.189	5.4.189
linux	linux_kernel	>= 5.11 < 5.15.33	5.15.33
linux	linux_kernel	>= 5.16 < 5.16.19	5.16.19
linux	linux_kernel	>= 5.17 < 5.17.2	5.17.2
linux	linux_kernel	>= 5.5 < 5.10.110	5.10.110

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.