In the Linux kernel, the following vulnerability has been resolved:
net: USB: Fix wrong-direction WARNING in plusb.c
The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. In modern kernels this error provokes a WARNING:
usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411 usbsubmiturb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 1 PID: 4645 Comm: dhcpcd Not tainted 6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:usbsubmiturb+0x14a7/0x1880 drivers/usb/core/urb.c:411 ... Call Trace: <TASK> usbstartwaiturb+0x101/0x4b0 drivers/usb/core/message.c:58 usbinternalcontrolmsg drivers/usb/core/message.c:102 [inline] usbcontrolmsg+0x320/0x4a0 drivers/usb/core/message.c:153 _usbnetreadcmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010 usbnetreadcmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068 plvendorreq drivers/net/usb/plusb.c:60 [inline] plsetQuickLinkfeatures drivers/net/usb/plusb.c:75 [inline] plreset+0x2f/0xf0 drivers/net/usb/plusb.c:85 usbnetopen+0xcc/0x5d0 drivers/net/usb/usbnet.c:889 _devopen+0x297/0x4d0 net/core/dev.c:1417 _devchangeflags+0x587/0x750 net/core/dev.c:8530 devchangeflags+0x97/0x170 net/core/dev.c:8602 devinetioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147 inetioctl+0x33f/0x380 net/ipv4/afinet.c:979 sockdoioctl+0xcc/0x230 net/socket.c:1169 sockioctl+0x1f8/0x680 net/socket.c:1286 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:870 [inline] _sesysioctl fs/ioctl.c:856 [inline] _x64sysioctl+0x197/0x210 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x39/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
The fix is to call usbnetwritecmd() instead of usbnetreadcmd() and remove the USBDIRIN flag.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25141fb4119112f4ebf8f00cf52014abbc8020b1",
"id": "CVE-2023-52742-091ea0a7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43379fcacea2dcee35d02efc9c8fe97807a503c9",
"id": "CVE-2023-52742-3e48989f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@811d581194f7412eda97acc03d17fc77824b561f",
"id": "CVE-2023-52742-40378200",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ad46ef772438c0596df370450d8bdc8a12dbfb",
"id": "CVE-2023-52742-46f65a50",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@811d581194f7412eda97acc03d17fc77824b561f",
"id": "CVE-2023-52742-52dc7236",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25141fb4119112f4ebf8f00cf52014abbc8020b1",
"id": "CVE-2023-52742-567470ad",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be271c52bf3554edcb8d124d1f8c7f777ee5727",
"id": "CVE-2023-52742-5adf9aab",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f69307f625904feed189008381fd83bd1a35b63",
"id": "CVE-2023-52742-682d28df",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f69307f625904feed189008381fd83bd1a35b63",
"id": "CVE-2023-52742-6e0b1484",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d2cf3fae701646061e295815bb7588d2f3671cc",
"id": "CVE-2023-52742-84990999",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43379fcacea2dcee35d02efc9c8fe97807a503c9",
"id": "CVE-2023-52742-c448af16",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d2cf3fae701646061e295815bb7588d2f3671cc",
"id": "CVE-2023-52742-d4025958",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19038997095037086406764138468939253377",
"31701807750524987616340510438127796860",
"34391405800274534008489318768968878134",
"112978186597860426076877085328227007276",
"338129725126402807404863058346524694369",
"138732725184896887837845410458105110410"
]
},
"target": {
"file": "drivers/net/usb/plusb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1be271c52bf3554edcb8d124d1f8c7f777ee5727",
"id": "CVE-2023-52742-daff8ffa",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65281188624778126971741261627428497905",
"length": 205.0
},
"target": {
"file": "drivers/net/usb/plusb.c",
"function": "pl_vendor_req"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ad46ef772438c0596df370450d8bdc8a12dbfb",
"id": "CVE-2023-52742-ec3ff970",
"deprecated": false,
"signature_version": "v1"
}
]