CVE-2024-41035 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
A flaw in the Linux kernel USB core allows duplicate endpoint descriptors to bypass checks, potentially causing system instability or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41035?
CVE-2024-41035 is a medium-severity vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk).
To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates.
Which versions are affected by CVE-2024-41035?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41035?
Apply the vendor's patch.
Is CVE-2024-41035 being exploited?
There is no known exploitation of CVE-2024-41035 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-41035, DEBIAN-CVE-2024-41035, GHSA-7v5q-9hp6-p273, UBUNTU-CVE-2024-41035.