In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpointisduplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk).
To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usbparseendpoint() and use the copy instead of the original when checking for duplicates.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41035.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"154102695785107545462144957786589492759",
"79342993088079384245245021137427598510",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8418fd083d1b90a6c007cf8dcf81aeae274727b",
"deprecated": false,
"id": "CVE-2024-41035-01e55a5c",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"154102695785107545462144957786589492759",
"79342993088079384245245021137427598510",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60abea505b726b38232a0ef410d2bd1994a77f78",
"deprecated": false,
"id": "CVE-2024-41035-0ad6ce72",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"217188436256583785067350395742090237784",
"251404281246976357629384556498566885060",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bd8534a1b83c65702aec3cab164170f8e584188",
"deprecated": false,
"id": "CVE-2024-41035-1772db2a",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5348.0,
"function_hash": "93978372873410200715463804147296085131"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60abea505b726b38232a0ef410d2bd1994a77f78",
"deprecated": false,
"id": "CVE-2024-41035-3c265593",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"217188436256583785067350395742090237784",
"251404281246976357629384556498566885060",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@647d61aef106dbed9c70447bcddbd4968e67ca64",
"deprecated": false,
"id": "CVE-2024-41035-64f01a55",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"217188436256583785067350395742090237784",
"251404281246976357629384556498566885060",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edcf317620d7c6a8354911b69b874cf89716646",
"deprecated": false,
"id": "CVE-2024-41035-6ff9b9a0",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"217188436256583785067350395742090237784",
"251404281246976357629384556498566885060",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf",
"deprecated": false,
"id": "CVE-2024-41035-72855c78",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5236.0,
"function_hash": "29243222784972130709561237018467733444"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edcf317620d7c6a8354911b69b874cf89716646",
"deprecated": false,
"id": "CVE-2024-41035-77f5b54c",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5236.0,
"function_hash": "29243222784972130709561237018467733444"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf",
"deprecated": false,
"id": "CVE-2024-41035-9669df81",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"217188436256583785067350395742090237784",
"251404281246976357629384556498566885060",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37514a5c1251a8c5c95c323f55050736e7069ac7",
"deprecated": false,
"id": "CVE-2024-41035-a65c935e",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5348.0,
"function_hash": "93978372873410200715463804147296085131"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8418fd083d1b90a6c007cf8dcf81aeae274727b",
"deprecated": false,
"id": "CVE-2024-41035-bc89b16a",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5236.0,
"function_hash": "29243222784972130709561237018467733444"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@647d61aef106dbed9c70447bcddbd4968e67ca64",
"deprecated": false,
"id": "CVE-2024-41035-bf184b00",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5201.0,
"function_hash": "294769873177775376411004296753977935088"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a368ecde8a5055b627749b09c6218ef793043e47",
"deprecated": false,
"id": "CVE-2024-41035-bffd2b85",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5236.0,
"function_hash": "29243222784972130709561237018467733444"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bd8534a1b83c65702aec3cab164170f8e584188",
"deprecated": false,
"id": "CVE-2024-41035-ce3afa64",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 5236.0,
"function_hash": "29243222784972130709561237018467733444"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37514a5c1251a8c5c95c323f55050736e7069ac7",
"deprecated": false,
"id": "CVE-2024-41035-fd66e694",
"signature_type": "Function",
"target": {
"function": "usb_parse_endpoint",
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44371265377283035781950104737186483990",
"217188436256583785067350395742090237784",
"251404281246976357629384556498566885060",
"56700405510565193174747261626866931029",
"133391744848726309044394948825773010060",
"40929258151990230282472880113086679199",
"291668790607014183759818567433827788899",
"234713842088653878199911053013136832260",
"331947892929309423788907047204061320828"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a368ecde8a5055b627749b09c6218ef793043e47",
"deprecated": false,
"id": "CVE-2024-41035-ff64417b",
"signature_type": "Line",
"target": {
"file": "drivers/usb/core/config.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41035.json"