Executive Summary

This vulnerability exists in the Linux kernel's USB network driver for the catc device. The catc_probe() function fills three USB Request Blocks (URBs) with hardcoded endpoint pipes without verifying the actual endpoint descriptors provided by the USB device.

A malformed USB device can present endpoints with transfer types that differ from what the driver expects, potentially causing incorrect behavior or security issues.

The fix involves adding an enumeration for endpoint numbers to replace magic constants and adding checks (usb_check_bulk_endpoints() and usb_check_int_endpoints()) after setting the USB interface to verify that the endpoint types match the expected types before use, rejecting devices with mismatched descriptors during probe time.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow a malformed USB device to cause the driver to operate on endpoints with unexpected transfer types, which may lead to incorrect driver behavior or potential security risks such as data corruption or denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by enabling basic endpoint checking in the catc USB driver within the Linux kernel.

To mitigate this vulnerability, ensure your Linux kernel is updated to a version that includes the fix which adds verification of endpoint types after usb_set_interface(), rejecting devices with mismatched descriptors at probe time.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Linux kernel's catc USB driver accepting malformed USB devices that present endpoint descriptors with transfer types differing from what the driver expects.

Detection would involve verifying the USB device endpoint descriptors to ensure they match the expected transfer types for the catc driver endpoints.

Since the vulnerability is related to USB endpoint descriptor mismatches, you can inspect connected USB devices and their endpoint descriptors using standard Linux USB inspection commands.

• Use `lsusb -v` to list detailed USB device descriptors, including endpoint information.
• Look specifically for devices using the catc driver and check if the endpoints 1 (bulk IN/OUT) and 2 (interrupt IN) have the correct transfer types.
• Commands like `usb-devices` can also provide endpoint information.
• There is no specific command provided in the context to automatically detect this vulnerability, but manual inspection of USB endpoint descriptors against expected types is the suggested approach.

Useful 0 Not Useful 0