In the Linux kernel, the following vulnerability has been resolved:
media: radio-shark: Add endpoint checks
The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver:
------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usbsubmiturb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usbhubwq hubevent RIP: 0010:usbsubmiturb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usbstartwaiturb+0x101/0x4b0 drivers/usb/core/message.c:58 usbbulkmsg+0x226/0x550 drivers/usb/core/message.c:387 sharkwritereg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88 ...
The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver).
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53644.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b580d0f03c4fc00013cd08f9ed96b87a08fd0d9",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-0184992c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53764a17f5d8f0d00b13297d06b5e65fa844288b",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-07c18c2f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76e31045ba030e94e72105c01b2e98f543d175ac",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-08e61a0f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c3057a1927fa0b9ed8948b6f3b56b4ff9fa63d3",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-251b465c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ed6a312ac1e7278f92b1b3d95377b335ae21e89",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-2a5f9730"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd72825b4fcb7ae4015e1c93b054f4c37a25684",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-2f8db24e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b580d0f03c4fc00013cd08f9ed96b87a08fd0d9",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-3c403588"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76e31045ba030e94e72105c01b2e98f543d175ac",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-3d5b45a4"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a30dce9d7f70f8438956f6a01142b926c301334",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-5352fdaf"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53764a17f5d8f0d00b13297d06b5e65fa844288b",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-5411459d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ed6a312ac1e7278f92b1b3d95377b335ae21e89",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-58f4fb7c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76e31045ba030e94e72105c01b2e98f543d175ac",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-5a304523"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd72825b4fcb7ae4015e1c93b054f4c37a25684",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-6d2a9181"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1bde4b4360c3d8a35504443efabd3243b802805",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-787471e1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1bde4b4360c3d8a35504443efabd3243b802805",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-7b158e5d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd72825b4fcb7ae4015e1c93b054f4c37a25684",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-8319ec42"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ed6a312ac1e7278f92b1b3d95377b335ae21e89",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-953e5809"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76e31045ba030e94e72105c01b2e98f543d175ac",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-98bcc5da"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1bde4b4360c3d8a35504443efabd3243b802805",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-9a97ebd7"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53764a17f5d8f0d00b13297d06b5e65fa844288b",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-a620a615"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c3057a1927fa0b9ed8948b6f3b56b4ff9fa63d3",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-a8c98742"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ed6a312ac1e7278f92b1b3d95377b335ae21e89",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-bee2fe0f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1bde4b4360c3d8a35504443efabd3243b802805",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-caba0455"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b580d0f03c4fc00013cd08f9ed96b87a08fd0d9",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-d12c8a2a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c3057a1927fa0b9ed8948b6f3b56b4ff9fa63d3",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-d38f7ddd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a30dce9d7f70f8438956f6a01142b926c301334",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-d4e2d0c0"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53764a17f5d8f0d00b13297d06b5e65fa844288b",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-e27b2510"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd72825b4fcb7ae4015e1c93b054f4c37a25684",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-e7ec78d5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c3057a1927fa0b9ed8948b6f3b56b4ff9fa63d3",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-ebb55392"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a30dce9d7f70f8438956f6a01142b926c301334",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1398.0,
"function_hash": "168567570508845622768859652128106497936"
},
"signature_version": "v1",
"id": "CVE-2023-53644-f011c1fa"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a30dce9d7f70f8438956f6a01142b926c301334",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/radio/radio-shark2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"107178345045277833265172233827156846688",
"95282993967968220089775834911497044641",
"201265344286787759684781523104020980791",
"15869036796645108383880397328495314754"
]
},
"signature_version": "v1",
"id": "CVE-2023-53644-f29b9652"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b580d0f03c4fc00013cd08f9ed96b87a08fd0d9",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/radio/radio-shark2.c",
"function": "usb_shark_probe"
},
"digest": {
"length": 1375.0,
"function_hash": "310419854256596161874030483840439747206"
},
"signature_version": "v1",
"id": "CVE-2023-53644-f864cfb0"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53644.json"