Linux Kernel up to 5.4.186/5.10.107/5.15.30/5.16.16 USB drivers/usb/core/urb.c usbtmc_ioctl_request privilege escalation

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.4.186/5.10.107/5.15.30/5.16.16. This impacts the function usbtmc_ioctl_request of the file drivers/usb/core/urb.c of the component USB Handler. Performing a manipulation results in an unknown weakness. This vulnerability is cataloged as CVE-2022-48834. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.4.186/5.10.107/5.15.30/5.16.16. It has been classified as problematic. This affects the function usbtmc_ioctl_request of the file drivers/usb/core/urb.c of the component USB Handler. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Fix bug in pipe direction for control transfers The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline] The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2022-48834 since 07/16/2024. The exploitability is told to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 5.4.187, 5.10.108, 5.15.31 or 5.16.17 eliminates this vulnerability. Applying the patch 700a0715854c/10a805334a11/c69aef9db878/5f6a2d63c68c/e9b667a82cdc is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.186
• 5.10.107
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9
• 5.16.10
• 5.16.11
• 5.16.12
• 5.16.13
• 5.16.14
• 5.16.15
• 5.16.16

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion