CVE-2022-49151

can: mcba_usb: properly check endpoint type

published February 26, 2025

CVSS
—
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: properly check endpoint type

Syzbot reported warning in usb_submit_urb() which is caused by wrong

endpoint type. We should check that in endpoint is actually present to

prevent this warning.

Found pipes are now saved to struct mcba_priv and code uses them

directly instead of making pipes in place.

Fail log:

| usb 5-1: BOGUS urb xfer, pipe 3 != type 1

| WARNING: CPU: 1 PID: 49 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502

| Modules linked in:

| CPU: 1 PID: 49 Comm: kworker/1:2 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0

| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014

| Workqueue: usb_hub_wq hub_event

| RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502

| ...

| Call Trace:

| <TASK>

| mcba_usb_start drivers/net/can/usb/mcba_usb.c:662 [inline]

| mcba_usb_probe+0x8a3/0xc50 drivers/net/can/usb/mcba_usb.c:858

| usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396

| call_driver_probe drivers/base/dd.c:517 [inline]

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Published
2025-02-26T01:55Z
EPSS history
Timeline
  • 26 FEB 01:55Z
    can: mcba_usb: properly check endpoint type
    cvelistv5