In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix incomplete endpoint checking
While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xxfindusbendpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panicon_warn' set on them.
Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usbfindcommon_endpoints() and ensuring that only expected endpoint types are present.
This patch has not been tested on real hardware.
[1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usbsubmiturb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usbstartwaiturb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xxresetdevice drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xxautoattach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comediautoconfig+0x238/0x380 drivers/comedi/drivers.c:1067 usbprobe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399 ...
Similar issue also found by Syzkaller:
[
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-14d5cd00",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0b268eeb087e324ef3ea71f8e6cabd07630517f",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/staging/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-1af62e6e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b8ae7e9297dd453f2977b011c5bc75eb20e71b",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-1e35a86d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59f33af9796160f851641d960bd93937f282c696",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-2cada72e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59f33af9796160f851641d960bd93937f282c696",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-74f332f5",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0b268eeb087e324ef3ea71f8e6cabd07630517f",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/staging/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-79682068",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a63ae0348d990e137cca04eced5b08379969ea9",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/staging/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-7f411537",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f15370e315976198f338b41611f37ce82af6cf54",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-83e2670e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac882d6b21bffecb57bcc4486701239eef5aa67b",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"5674671605307925151019249263653519798",
"99953284761361885123491038867944529723",
"181756924561746372185334211267105676493",
"277291794733826939194286283883335317016",
"92565742419270112793386032933978570210",
"23886025232814398284003600726392139295",
"161017300440378684441615956306718324025",
"201055243473875547977934067550307690908",
"87185093561637490938404337824536620220",
"242296856682219035591982529363926825974",
"234148114368921881817246255431278811623",
"208763488740379693138346372757635625858",
"135928064306355604351983986092011564754",
"55690523592785934021847955579835189717",
"848701336552663966686295159203841118",
"142205874253338622498655728963181957547",
"83699226354421752055251148329847254729",
"291383091607946732521878270497088491066",
"43363416409896565563986039679323655617",
"66802813452014593500885961703493747120",
"313428397748629476856005412010384297357",
"277493313178991947386694441424231561882",
"87743439913194883611849969258015785496",
"182975950752306851276261880651889708995"
],
"threshold": 0.9
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c"
},
"signature_type": "Line",
"id": "CVE-2024-27001-9002feaa",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ec3514a7d35ad9cfab600187612c29f669069d2",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/staging/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-a6cb7722",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b8ae7e9297dd453f2977b011c5bc75eb20e71b",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-b48bde1f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ec3514a7d35ad9cfab600187612c29f669069d2",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/staging/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-b8b4a71b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a63ae0348d990e137cca04eced5b08379969ea9",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-d39aa08b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac882d6b21bffecb57bcc4486701239eef5aa67b",
"deprecated": false
},
{
"digest": {
"length": 696.0,
"function_hash": "56402043948787805989074170867436428225"
},
"target": {
"file": "drivers/staging/comedi/drivers/vmk80xx.c",
"function": "vmk80xx_find_usb_endpoints"
},
"signature_type": "Function",
"id": "CVE-2024-27001-e3894212",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f15370e315976198f338b41611f37ce82af6cf54",
"deprecated": false
}
]