CVE-2022-48836: Input: aiptek - properly check endpoint type
In the Linux kernel, the following vulnerability has been resolved:
Input: aiptek - properly check endpoint type
Syzbot reported warning in usbsubmiturb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint.
Fix it by replacing old desc.bNumEndpoints check with usbfindcommonendpoints() helper for finding endpoints
Fail log:
usb 5-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usbsubmiturb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usbhubwq hubevent ... Call Trace: aiptekopen+0xd5/0x130 drivers/input/tablet/aiptek.c:830 inputopendevice+0x1bb/0x320 drivers/input/input.c:629 kbdconnect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Input: aiptek - properly check endpoint type
Syzbot reported warning in usbsubmiturb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint.
Fix it by replacing old desc.bNumEndpoints check with usbfindcommonendpoints() helper for finding endpoints
Fail log:
usb 5-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usbsubmiturb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usbhubwq hubevent ... Call Trace: <TASK> aiptekopen+0xd5/0x130 drivers/input/tablet/aiptek.c:830 inputopendevice+0x1bb/0x320 drivers/input/input.c:629 kbdconnect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.9.308 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.14.273 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.236 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.187 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.108 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.31 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.16.17 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.17 - Configuration
Update the aiptek driver to properly validate USB endpoint types by replacing the old desc.bNumEndpoints-only check with the usb_find_common_endpoints() helper for finding endpoints (add the missing endpoint type check to prevent the WARNING in usb_submit_urb() and the 'BOGUS urb xfer, pipe 1 != type 3' condition).
Linux kernel (drivers/input/tablet/aiptek.c) endpoint type check during endpoint discovery/open = use usb_find_common_endpoints() instead of only checking desc.bNumEndpoints
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48836?
CVE-2022-48836 is a vulnerability in the Linux kernel that impacts the proper handling of USB endpoint types.
How do I fix CVE-2022-48836?
To fix CVE-2022-48836, update to one of the patched kernel versions such as 4.9.308, 4.14.273, 4.19.236, or newer versions listed in the affected software.
Which systems are affected by CVE-2022-48836?
CVE-2022-48836 affects Linux kernel versions prior to the fixed versions released, including various distributions using those kernels.
What specific package needs to be updated for CVE-2022-48836?
The kernel package needs to be updated to the latest version provided by your distribution that addresses CVE-2022-48836.
Can CVE-2022-48836 be exploited remotely?
Yes, CVE-2022-48836 may have potential implications that could allow for exploitation remotely under certain conditions.