In the Linux kernel, the following vulnerability has been resolved:
Input: aiptek - properly check endpoint type
Syzbot reported warning in usbsubmiturb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint.
Fix it by replacing old desc.bNumEndpoints check with usbfindcommon_endpoints() helper for finding endpoints
Fail log:
usb 5-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usbsubmiturb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usbhubwq hubevent ... Call Trace: <TASK> aiptekopen+0xd5/0x130 drivers/input/tablet/aiptek.c:830 inputopendevice+0x1bb/0x320 drivers/input/input.c:629 kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 4890.0, "function_hash": "231330488919670546368893747257323066240" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5600f6986628dde8881734090588474f54a540a8", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-03a07e27" }, { "signature_version": "v1", "digest": { "length": 4891.0, "function_hash": "212988488909730538105333051625734689816" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57277a8b5d881e02051ba9d7f6cb3f915c229821", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-1a017138" }, { "signature_version": "v1", "digest": { "length": 4890.0, "function_hash": "231330488919670546368893747257323066240" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0d43d22d24182b94d7eb78a2bf6ae7e2b33204a", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-2358ff2f" }, { "signature_version": "v1", "digest": { "length": 4891.0, "function_hash": "212988488909730538105333051625734689816" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc8033a55e2796d21e370260a784ac9fbb8305a6", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-3f1045ae" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57277a8b5d881e02051ba9d7f6cb3f915c229821", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-55876f2f" }, { "signature_version": "v1", "digest": { "length": 4891.0, "function_hash": "201942210099368018348218087115267553649" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6de20111cd0bb7da9b2294073ba00c7d2a6c1c4f", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-5f9f324d" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35069e654bcab567ff8b9f0e68e1caf82c15dcd7", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-75c93a18" }, { "signature_version": "v1", "digest": { "length": 4891.0, "function_hash": "201942210099368018348218087115267553649" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e732b0412f8c603d1e998f3bff41b5e7d5c3914c", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-8c7c8055" }, { "signature_version": "v1", "digest": { "length": 4890.0, "function_hash": "231330488919670546368893747257323066240" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e762f57ff255af28236cd02ca9fc5c7e5a089d31", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-9484a0b0" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0d43d22d24182b94d7eb78a2bf6ae7e2b33204a", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-a80d0cd9" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5600f6986628dde8881734090588474f54a540a8", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-b83fae09" }, { "signature_version": "v1", "digest": { "length": 4890.0, "function_hash": "231330488919670546368893747257323066240" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35069e654bcab567ff8b9f0e68e1caf82c15dcd7", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c", "function": "aiptek_probe" }, "signature_type": "Function", "id": "CVE-2022-48836-c1d93f05" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc8033a55e2796d21e370260a784ac9fbb8305a6", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-c42d6bcf" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e732b0412f8c603d1e998f3bff41b5e7d5c3914c", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-e8d22c20" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6de20111cd0bb7da9b2294073ba00c7d2a6c1c4f", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-e9eebb8d" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "336470600688808638972073704541006670574", "256530377841779357595680772230624459374", "28023544448754520195889800520061895454", "2038978860949426365130935066683742804", "241604081637748369744716274033247497768", "151533787909499202735688650428781476842", "292279929793851308105898720361371644626", "221637083209713752155401193473224749159", "333757873018700966990688260950607950905", "1969322703207397086994687548935007647", "86059692615193358323279228740203390653" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e762f57ff255af28236cd02ca9fc5c7e5a089d31", "deprecated": false, "target": { "file": "drivers/input/tablet/aiptek.c" }, "signature_type": "Line", "id": "CVE-2022-48836-f9c695e5" } ] }