CVE-2023-4010

Published: 31 July 2023

A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service.

Notes

Priority reason:
Requires physical access to insert a malicious device, and the denial of service is simply log flooding due to a malforrmed response.

issue is not clear; the function the reporter mentions
does not exist. though there is the similar usb_giveback_urb_bh().
However, as of 6.3.7, which the reporter claims is vulnerable,
that function contained no gotos, though it did until 26c6c2f8a907
("USB: HCD: Fix URB giveback issue in tasklet function"), which
landed in v6.0-rc1.

This is a USB device using interrupt transfers. So,
as soon as a response is received, it submits another URB, waiting
for the next "interrupt" to happen. That is totally normal. But
as the response is malformed, the imon driver outputs a warning
without any throttling. There is no system lockup happening. The
imon driver has been issuing those warnings since its inception,
so using that as the break commit.

Status

Severity score breakdown

References

• https://github.com/wanrenmi/a-usb-kernel-bug
• https://github.com/wanrenmi/a-usb-kernel-bug/issues/1
• https://access.redhat.com/security/cve/CVE-2023-4010
• https://www.cve.org/CVERecord?id=CVE-2023-4010
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2227726
• https://bugzilla.suse.com/show_bug.cgi?id=1214030