CVE-2022-48836

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: aiptek - properly check endpoint type

Syzbot reported warning in usb_submit_urb() which is caused by wrong

endpoint type. There was a check for the number of endpoints, but not

for the type of endpoint.

Fix it by replacing old desc.bNumEndpoints check with

usb_find_common_endpoints() helper for finding endpoints

Fail log:

usb 5-1: BOGUS urb xfer, pipe 1 != type 3

WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502

Modules linked in:

CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014

Workqueue: usb_hub_wq hub_event

...

Call Trace:

<TASK>

aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830

input_open_device+0x1bb/0x320 drivers/input/input.c:629

kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References