cbcvebase.
CVE-2024-41035
published 2024-07-29

CVE-2024-41035: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.30%
22.2th percentile
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk). To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates.

Affected

48 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.106-1 (bookworm)linux 6.1.106-1 (bookworm)
debianlinux-6.1< linux 6.1.106-1 (bookworm)linux 6.1.106-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < d8418fd083d1b90a6c007cf8dcf81aeae274727bd8418fd083d1b90a6c007cf8dcf81aeae274727b
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < 60abea505b726b38232a0ef410d2bd1994a77f7860abea505b726b38232a0ef410d2bd1994a77f78
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < d09dd21bb5215d583ca9a1cb1464dbc77a7e88cfd09dd21bb5215d583ca9a1cb1464dbc77a7e88cf
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < 2bd8534a1b83c65702aec3cab164170f8e5841882bd8534a1b83c65702aec3cab164170f8e584188
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < 9edcf317620d7c6a8354911b69b874cf897166469edcf317620d7c6a8354911b69b874cf89716646
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < 647d61aef106dbed9c70447bcddbd4968e67ca64647d61aef106dbed9c70447bcddbd4968e67ca64
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < 37514a5c1251a8c5c95c323f55050736e7069ac737514a5c1251a8c5c95c323f55050736e7069ac7
linuxlinux>= 0a8fd1346254974c3a852338508e4a4cddbb35f1 < a368ecde8a5055b627749b09c6218ef793043e47a368ecde8a5055b627749b09c6218ef793043e47
linuxlinux>= 3.10.106 < 3.113.11
linuxlinux>= 3.12.70 < 3.133.13
linuxlinux>= 3.16.42 < 3.173.17
linuxlinux>= 3.2.87 < 3.33.3
linuxlinux>= 4.1.39 < 4.24.2
linuxlinux>= 4.4.42 < 4.54.5
linuxlinux>= 4.9.3 < 4.104.10

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.