CVE-2024-45011 char: xillybus: Check USB endpoints when probing device
A missing check in the XillyUSB driver allows a malicious device to cause a null pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45011?
CVE-2024-45011 is a medium-severity vulnerability in Linux kernel, published on 11 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
char: xillybus: Check USB endpoints when probing device
Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type.
All XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at address 1. This is verified in xillyusb_setup_base_eps().
On top of that, a XillyUSB device may have additional Bulk OUT endpoints. The information about these endpoints' addresses is deduced from a data structure (the IDT) that the driver fetches from the device while probing it. These endpoints are checked in setup_channels().
A XillyUSB device never has more than one IN endpoint, as all data towards the host is multiplexed in this single Bulk IN endpoint. This is why setup_channels() only checks OUT endpoints.
Which versions are affected by CVE-2024-45011?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-45011?
Apply the vendor's patch.
Is CVE-2024-45011 being exploited?
There is no known exploitation of CVE-2024-45011 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49203, AZL-49254, BELL-CVE-2024-45011, DEBIAN-CVE-2024-45011, GHSA-xg5q-q7c3-jvmv, UBUNTU-CVE-2024-45011.