In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: verify the expected usb_endpoints are present
The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. (In this case there was an interrupt endpoint where the driver expected a bulk endpoint.) The kernel needs to be able to handle such devices without getting an internal error.
usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usbsubmiturb+0xce2/0x1430 drivers/usb/core/urb.c:493 Modules linked in: CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events requestfirmwareworkfunc RIP: 0010:usbsubmiturb+0xce2/0x1430 drivers/usb/core/urb.c:493 Call Trace: ath9khifusballocrxurbs drivers/net/wireless/ath/ath9k/hifusb.c:908 [inline] ath9khifusballocurbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hifusb.c:1019 ath9khifusbdevinit drivers/net/wireless/ath/ath9k/hifusb.c:1109 [inline] ath9khifusbfirmwarecb+0x142/0x530 drivers/net/wireless/ath/ath9k/hifusb.c:1242 requestfirmwareworkfunc+0x12e/0x240 drivers/base/firmwareloader/main.c:1097 processonework+0x9af/0x1600 kernel/workqueue.c:2279 workerthread+0x61d/0x12f0 kernel/workqueue.c:2425 kthread+0x3b4/0x4a0 kernel/kthread.c:313 retfromfork+0x22/0x30 arch/x86/entry/entry64.S:299
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c319196a0e34ed2e66d6f876f58d8d446335c2a7",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-0c1efb66"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d008a202a0528a058bac658e657c010ce8534f4a",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-3797665c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d008a202a0528a058bac658e657c010ce8534f4a",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-48c119b8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@932f0a5e829fb0b823f96d7fa9a0f4fc96660b77",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-7ffa5054"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16ef02bad239f11f322df8425d302be62f0443ce",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-8f30b9ed"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca57748593ddd8e46d033fbaeb9d01ec533a6bfe",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-933509a5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7e6d681e00a96cde2b32a15ffa70e1be2e3209",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-9f0caa34"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d2eccf52ea0215c8d386b62af0b5fd4fc122bd5",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-a098e9b1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16ef02bad239f11f322df8425d302be62f0443ce",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-a2a8bfb9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64436af0bc3c9e579be761d7684f228fb95f3bb",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-b1e4a0c1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7e6d681e00a96cde2b32a15ffa70e1be2e3209",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-c398d55d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1824ccabee5445347b83642e4087cc2eca070343",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-c427f7d9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca57748593ddd8e46d033fbaeb9d01ec533a6bfe",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-c58cabce"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@932f0a5e829fb0b823f96d7fa9a0f4fc96660b77",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-ce64f080"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64436af0bc3c9e579be761d7684f228fb95f3bb",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-dcf1dd8f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c319196a0e34ed2e66d6f876f58d8d446335c2a7",
"target": {
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"line_hashes": [
"327058095455546673957712867300955336305",
"144020005997509139137942190575254967521",
"187185885667045081512326189846148111894",
"181431454387259537965633874340854369185",
"61080358140159049885653503923169822961",
"275335970783449917629643092689757084719",
"33199507869590963064815736139671419387"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-50297-e722dc23"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1824ccabee5445347b83642e4087cc2eca070343",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-eadcce6f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d2eccf52ea0215c8d386b62af0b5fd4fc122bd5",
"target": {
"function": "ath9k_hif_usb_probe",
"file": "drivers/net/wireless/ath/ath9k/hif_usb.c"
},
"digest": {
"function_hash": "244597339703282971891347174921413017442",
"length": 687.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-50297-f41dfd50"
}
]