In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: add a proper sanity check for endpoints
Syzkaller reports [1] hitting a warning which is caused by presence of a wrong endpoint type at the URB sumbitting stage. While there was a check for a specific 4th endpoint, since it can switch types between bulk and interrupt, other endpoints are trusted implicitly. Similar warning is triggered in a couple of other syzbot issues [2].
Fix the issue by doing a comprehensive check of all endpoints taking into account difference between high- and full-speed configuration.
[1] Syzkaller report: ... WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usbsubmiturb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> carl9170usbsendrxirqurb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 carl9170usbinitdevice drivers/net/wireless/ath/carl9170/usb.c:939 [inline] carl9170usbfirmwarefinish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] carl9170usbfirmwarestep2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 requestfirmwareworkfunc+0x130/0x240 drivers/base/firmwareloader/main.c:1107 processonework+0x9bf/0x1710 kernel/workqueue.c:2289 workerthread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:308 </TASK>
[2] Related syzkaller crashes:
[
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-05607cec",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fa08a55201ab9be72bacb8ea93cf752d338184f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-074c4451",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a9892bf24c906b4d6b587f8759ca38bff672582",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-0b3fd7d1",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-0d1cb87a",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03ddc74bdfd71b84a55c9f2185d8787f258422cd",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-0dee2cb6",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac3ed46a8741d464bc70ebdf7433c1d786cf329d",
"digest": {
"length": 1618.0,
"function_hash": "190580834656872678471304858350333087863"
},
"deprecated": false,
"id": "CVE-2024-38567-16f71036",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8650725bb0a48b206d5a8ddad3a7488f9a5985b7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-63057c5c",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@265c3cda471c26e0f25d0c755da94e1eb15d7a0c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-6651c5d2",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-692380e4",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-8b564bff",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb0f2fc3ff5806cc572cd9055ce7c52a01e97645",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-a1865068",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@265c3cda471c26e0f25d0c755da94e1eb15d7a0c",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-a54e5472",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb0f2fc3ff5806cc572cd9055ce7c52a01e97645",
"digest": {
"length": 1618.0,
"function_hash": "190580834656872678471304858350333087863"
},
"deprecated": false,
"id": "CVE-2024-38567-be783d73",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac3ed46a8741d464bc70ebdf7433c1d786cf329d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-c2090b27",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03ddc74bdfd71b84a55c9f2185d8787f258422cd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-ca10b930",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8650725bb0a48b206d5a8ddad3a7488f9a5985b7",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-d2eb8242",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "carl9170_usb_probe",
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0fa08a55201ab9be72bacb8ea93cf752d338184f",
"digest": {
"length": 1593.0,
"function_hash": "32711511491358884221862106611748974424"
},
"deprecated": false,
"id": "CVE-2024-38567-d8f8369d",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/carl9170/usb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a9892bf24c906b4d6b587f8759ca38bff672582",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317794427963652489019535885917821161503",
"333840336689031707455071896753474250582",
"179383564447936346636071824577430503510"
]
},
"deprecated": false,
"id": "CVE-2024-38567-f3ba4503",
"signature_type": "Line"
}
]