CVE-2024-41097

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: fix endpoint checking in cxacru_bind()

Syzbot is still reporting quite an old issue [1] that occurs due to

incomplete checking of present usb endpoints. As such, wrong

endpoints types may be used at urb sumbitting stage which in turn

triggers a warning in usb_submit_urb().

Fix the issue by verifying that required endpoint types are present

for both in and out endpoints, taking into account cmd endpoint type.

Unfortunately, this patch has not been tested on real hardware.

[1] Syzbot report:

usb 1-1: BOGUS urb xfer, pipe 1 != type 3

WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502

Modules linked in:

CPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Workqueue: usb_hub_wq hub_event

RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References