linux-cve-announce - CVE-2023-52742: net: USB: Fix wrong-direction WARNING in plusb.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052102-CVE-2023-52742-005f@gregkh>
Date: Tue, 21 May 2024 17:23:19 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52742: net: USB: Fix wrong-direction WARNING in plusb.c

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: USB: Fix wrong-direction WARNING in plusb.c

The syzbot fuzzer detected a bug in the plusb network driver: A
zero-length control-OUT transfer was treated as a read instead of a
write.  In modern kernels this error provokes a WARNING:

usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411
usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411
Modules linked in:
CPU: 1 PID: 4645 Comm: dhcpcd Not tainted
6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/12/2023
RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411
..
Call Trace:
 <TASK>
 usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58
 usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
 usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153
 __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010
 usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068
 pl_vendor_req drivers/net/usb/plusb.c:60 [inline]
 pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline]
 pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85
 usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889
 __dev_open+0x297/0x4d0 net/core/dev.c:1417
 __dev_change_flags+0x587/0x750 net/core/dev.c:8530
 dev_change_flags+0x97/0x170 net/core/dev.c:8602
 devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147
 inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979
 sock_do_ioctl+0xcc/0x230 net/socket.c:1169
 sock_ioctl+0x1f8/0x680 net/socket.c:1286
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and
remove the USB_DIR_IN flag.

The Linux kernel CVE team has assigned CVE-2023-52742 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 4.14.306 with commit f0ad46ef7724
	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 4.19.273 with commit 6f69307f6259
	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 5.4.232 with commit 43379fcacea2
	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 5.10.168 with commit 1be271c52bf3
	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 5.15.94 with commit 25141fb41191
	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 6.1.12 with commit 0d2cf3fae701
	Issue introduced in 2.6.14 with commit 090ffa9d0e90 and fixed in 6.2 with commit 811d581194f7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52742
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/plusb.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f0ad46ef772438c0596df370450d8bdc8a12dbfb
	https://git.kernel.org/stable/c/6f69307f625904feed189008381fd83bd1a35b63
	https://git.kernel.org/stable/c/43379fcacea2dcee35d02efc9c8fe97807a503c9
	https://git.kernel.org/stable/c/1be271c52bf3554edcb8d124d1f8c7f777ee5727
	https://git.kernel.org/stable/c/25141fb4119112f4ebf8f00cf52014abbc8020b1
	https://git.kernel.org/stable/c/0d2cf3fae701646061e295815bb7588d2f3671cc
	https://git.kernel.org/stable/c/811d581194f7412eda97acc03d17fc77824b561f