In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix incomplete endpoint checking
While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xxfindusbendpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panicon_warn' set on them.
Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usbfindcommon_endpoints() and ensuring that only expected endpoint types are present.
This patch has not been tested on real hardware.
[1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usbsubmiturb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usbstartwaiturb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xxresetdevice drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xxautoattach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comediautoconfig+0x238/0x380 drivers/comedi/drivers.c:1067 usbprobe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399 ...
Similar issue also found by Syzkaller:
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-14d5cd00", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0b268eeb087e324ef3ea71f8e6cabd07630517f" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/staging/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-1af62e6e", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b8ae7e9297dd453f2977b011c5bc75eb20e71b" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-1e35a86d", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59f33af9796160f851641d960bd93937f282c696" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-28a644a4", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1718530e3f640b7d5f0050e725216eab57a85d8" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-2cada72e", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59f33af9796160f851641d960bd93937f282c696" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-74f332f5", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0b268eeb087e324ef3ea71f8e6cabd07630517f" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/staging/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-79682068", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a63ae0348d990e137cca04eced5b08379969ea9" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/staging/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-7f411537", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f15370e315976198f338b41611f37ce82af6cf54" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-83e2670e", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac882d6b21bffecb57bcc4486701239eef5aa67b" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/comedi/drivers/vmk80xx.c" }, "id": "CVE-2024-27001-9002feaa", "digest": { "line_hashes": [ "5674671605307925151019249263653519798", "99953284761361885123491038867944529723", "181756924561746372185334211267105676493", "277291794733826939194286283883335317016", "92565742419270112793386032933978570210", "23886025232814398284003600726392139295", "161017300440378684441615956306718324025", "201055243473875547977934067550307690908", "87185093561637490938404337824536620220", "242296856682219035591982529363926825974", "234148114368921881817246255431278811623", "208763488740379693138346372757635625858", "135928064306355604351983986092011564754", "55690523592785934021847955579835189717", "848701336552663966686295159203841118", "142205874253338622498655728963181957547", "83699226354421752055251148329847254729", "291383091607946732521878270497088491066", "43363416409896565563986039679323655617", "66802813452014593500885961703493747120", "313428397748629476856005412010384297357", "277493313178991947386694441424231561882", "87743439913194883611849969258015785496", "182975950752306851276261880651889708995" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ec3514a7d35ad9cfab600187612c29f669069d2" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/staging/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-a6cb7722", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3b8ae7e9297dd453f2977b011c5bc75eb20e71b" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-b48bde1f", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ec3514a7d35ad9cfab600187612c29f669069d2" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/staging/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-b8b4a71b", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a63ae0348d990e137cca04eced5b08379969ea9" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-d34be367", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1718530e3f640b7d5f0050e725216eab57a85d8" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-d39aa08b", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac882d6b21bffecb57bcc4486701239eef5aa67b" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/staging/comedi/drivers/vmk80xx.c", "function": "vmk80xx_find_usb_endpoints" }, "id": "CVE-2024-27001-e3894212", "digest": { "length": 696.0, "function_hash": "56402043948787805989074170867436428225" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f15370e315976198f338b41611f37ce82af6cf54" } ] }