Executive brief
A vulnerability in the Linux kernel's carl9170 wireless driver could allow a local attacker to cause a system crash. The issue stems from insufficient validation of USB device components (endpoints) when a wireless adapter is initialized. This could lead to a denial-of-service, impacting the availability of the affected system.
Technical details
A vulnerability exists in the carl9170 USB Wi-Fi driver within the Linux kernel due to missing sanity checks for USB endpoints. Specifically, the driver implicitly trusts certain endpoint types during URB (USB Request Block) submission. If a malicious or malformed USB device provides unexpected endpoint types (e.g., switching between bulk and interrupt), it triggers a kernel warning in 'usb_submit_urb'. This can be exploited by a local user or via a physical USB device to cause a denial-of-service (kernel panic/hang). The fix introduces comprehensive endpoint checks for both high-speed and full-speed configurations during the probe stage.
Affected products
- Linux Linux Kernel 2.6.37 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-06-19: advisory: NVD publication date
- 2024-05-30: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/03ddc74bdfd71b84a55c9f2185d8787f258422cd
- https://git.kernel.org/stable/c/0fa08a55201ab9be72bacb8ea93cf752d338184f
- https://git.kernel.org/stable/c/265c3cda471c26e0f25d0c755da94e1eb15d7a0c
- https://git.kernel.org/stable/c/62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd
- https://git.kernel.org/stable/c/6a9892bf24c906b4d6b587f8759ca38bff672582
- https://git.kernel.org/stable/c/8650725bb0a48b206d5a8ddad3a7488f9a5985b7
- https://git.kernel.org/stable/c/ac3ed46a8741d464bc70ebdf7433c1d786cf329d