CVE-2024-57993 HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
A missing endpoint check in the Linux kernel's Thrustmaster HID driver can cause a warning or crash when processing malformed USB devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57993?
CVE-2024-57993 is a medium-severity vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver[1]. There is a number of similar, already fixed issues [2]. In this case as in others, implementing check for endpoint type fixes the issue.
[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 [2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622
Which versions are affected by CVE-2024-57993?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-57993?
Apply the vendor's patch.
Is CVE-2024-57993 being exploited?
There is no known exploitation of CVE-2024-57993 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-68757, BELL-CVE-2024-57993, DEBIAN-CVE-2024-57993, GHSA-f4cr-gmw4-8qpw, ROOT-OS-UBUNTU-2204-CVE-2024-57993, ROOT-OS-UBUNTU-2404-CVE-2024-57993 and 1 more.