CVE-2025-21877: usbnet: gl620a: fix endpoint checking in genelink_bind()
In the Linux kernel, the following vulnerability has been resolved:
usbnet: gl620a: fix endpoint checking in genelinkbind()
Syzbot reports [1] a warning in usbsubmiturb() triggered by inconsistencies between expected and actually present endpoints in gl620a driver. Since genelinkbind() does not properly verify whether specified eps are in fact provided by the device, in this case, an artificially manufactured one, one may get a mismatch.
Fix the issue by resorting to a usbnet utility function usbnetgetendpoints(), usually reserved for this very problem. Check for endpoints and return early before proceeding further if any are missing.
[1] Syzbot report: usb 5-1: Manufacturer: syz usb 5-1: SerialNumber: syz usb 5-1: config 0 descriptor?? gl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummyhcd.0-1, ... ------------[ cut here ]------------ usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usbsubmiturb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Modules linked in: CPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: mld mldifcwork RIP: 0010:usbsubmiturb+0xe4b/0x1730 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usbnetstartxmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467 netdevstartxmit include/linux/netdevice.h:5002 [inline] netdevstartxmit include/linux/netdevice.h:5011 [inline] xmitone net/core/dev.c:3590 [inline] devhardstartxmit+0x9a/0x7b0 net/core/dev.c:3606 schdirectxmit+0x1ae/0xc30 net/sched/schgeneric.c:343 devxmitskb net/core/dev.c:3827 [inline] devqueuexmit+0x13d4/0x43e0 net/core/dev.c:4400 devqueuexmit include/linux/netdevice.h:3168 [inline] neighresolveoutput net/core/neighbour.c:1514 [inline] neighresolveoutput+0x5bc/0x950 net/core/neighbour.c:1494 neighoutput include/net/neighbour.h:539 [inline] ip6finishoutput2+0xb1b/0x2070 net/ipv6/ip6output.c:141 ip6finishoutput net/ipv6/ip6output.c:215 [inline] ip6finishoutput+0x3f9/0x1360 net/ipv6/ip6output.c:226 NFHOOKCOND include/linux/netfilter.h:303 [inline] ip6output+0x1f8/0x540 net/ipv6/ip6output.c:247 dstoutput include/net/dst.h:450 [inline] NFHOOK include/linux/netfilter.h:314 [inline] NFHOOK include/linux/netfilter.h:308 [inline] mldsendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819 mldsendcr net/ipv6/mcast.c:2120 [inline] mldifcwork+0x740/0xca0 net/ipv6/mcast.c:2651 processonework+0x9c5/0x1ba0 kernel/workqueue.c:3229 processscheduledworks kernel/workqueue.c:3310 [inline] workerthread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 retfromfork+0x45/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the gl620a driver, update genelink_bind() to use usbnet_get_endpoints() to verify that the specified endpoints are provided by the device, and return early when required endpoints are missing or inconsistent.