Description

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors(): BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011 CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 ... Allocated by task 758: ... __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc+0x5e/0x190 mm/slab_common.c:979 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:680 [inline] usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887 usb_enumerate_device drivers/usb/core/hub.c:2407 [inline] usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545 As analyzed by Khazhy Kumykov, the cause of this bug is a race between read_descriptors() and hub_port_init(): The first routine uses a field in udev->descriptor, not expecting it to change, while the second overwrites it. Prior to commit 45bf39f8df7f ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file") this race couldn't occur, because the routines were mutually exclusive thanks to the device locking. Removing that locking from read_descriptors() exposed it to the race. The best way to fix the bug is to keep hub_port_init() from changing udev->descriptor once udev has been initialized and registered. Drivers expect the descriptors stored in the kernel to be immutable; we should not undermine this expectation. In fact, this change should have been made long ago. So now hub_port_init() will take an additional argument, specifying a buffer in which to store the device descriptor it reads. (If udev has not yet been initialized, the buffer pointer will be NULL and then hub_port_init() will store the device descriptor in udev as before.) This eliminates the data race responsible for the out-of-bounds read. The changes to hub_port_init() appear more extensive than they really are, because of indentation changes resulting from an attempt to avoid writing to other parts of the usb_device structure after it has been initialized. Similar changes should be made to the code that reads the BOS descriptor, but that can be handled in a separate patch later on. This patch is sufficient to fix the bug found by syzbot.

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  6.4 MEDIUM

Vector:  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5	Mailing List  Patch
https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee	Mailing List  Patch
https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f	Mailing List  Patch
https://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848	Mailing List  Patch
https://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5	Mailing List  Patch
https://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b	Mailing List  Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-125	Out-of-bounds Read	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 8/21/2024 1:28:49 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 547 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.171 up to (excluding) 5.10.195 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.97 up to (excluding) 5.15.132 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.15 up to (excluding) 6.1.53 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.3 up to (excluding) 6.4.16 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versio
Added	CVSS V3.1		NIST AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-125
Changed	Reference Type	https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5 No Types Assigned	https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5 Mailing List, Patch
Changed	Reference Type	https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee No Types Assigned	https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee Mailing List, Patch
Changed	Reference Type	https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f No Types Assigned	https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f Mailing List, Patch
Changed	Reference Type	https://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848 No Types Assigned	https://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848 Mailing List, Patch
Changed	Reference Type	https://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5 No Types Assigned	https://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5 Mailing List, Patch
Changed	Reference Type	https://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b No Types Assigned	https://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b Mailing List, Patch

New CVE Received by NIST 7/16/2024 6:15:02 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 2832 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors(): BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011 CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0 Hardware name: Google Google Compute Engine/Googl
Added	Reference		kernel.org https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b [No types assigned]