Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-52886— USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于USB模块中发现竞争条件问题。hub_port_init函数在初始化时可能会覆盖udev->descriptor，导致数据竞争。

AI Predicted 5.5 Difficulty: Hard EPSS 0.33% · P24

Affected Version Matrix 25

VendorProduct Version RangeStatus
Linux Linux 218925bfd5d1436e337c4f961e9c149fbe32de6d< 9d241c5d9a9b7ad95c90c6520272fe404d5ac88f affected
77358093331e9769855140bf94a3f00ecdcf4bb1< 7fe9d87996062f5eb0ca476ad0257f79bf43aaf5 affected
c87fb861ec185fdc578b4fdc6a05920b6a843840< 8186596a663506b1124bede9fde6f243ef9f37ee affected
45bf39f8df7f05efb83b302c65ae3b9bc92b7065< b4a074b1fb222164ed7d5c0b8c922dc4a0840848 affected
45bf39f8df7f05efb83b302c65ae3b9bc92b7065< b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5 affected
45bf39f8df7f05efb83b302c65ae3b9bc92b7065< ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b affected
6badaf880edf51a2da7a439699676394dfdef3e5 affected
5f35b5d3bd6914c68f743741443dfd3a64b0e455 affected
… +17 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-52886

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors(): BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011 CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 ... Allocated by task 758: ... __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc+0x5e/0x190 mm/slab_common.c:979 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:680 [inline] usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887 usb_enumerate_device drivers/usb/core/hub.c:2407 [inline] usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545 As analyzed by Khazhy Kumykov, the cause of this bug is a race between read_descriptors() and hub_port_init(): The first routine uses a field in udev->descriptor, not expecting it to change, while the second overwrites it. Prior to commit 45bf39f8df7f ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file") this race couldn't occur, because the routines were mutually exclusive thanks to the device locking. Removing that locking from read_descriptors() exposed it to the race. The best way to fix the bug is to keep hub_port_init() from changing udev->descriptor once udev has been initialized and registered. Drivers expect the descriptors stored in the kernel to be immutable; we should not undermine this expectation. In fact, this change should have been made long ago. So now hub_port_init() will take an additional argument, specifying a buffer in which to store the device descriptor it reads. (If udev has not yet been initialized, the buffer pointer will be NULL and then hub_port_init() will store the device descriptor in udev as before.) This eliminates the data race responsible for the out-of-bounds read. The changes to hub_port_init() appear more extensive than they really are, because of indentation changes resulting from an attempt to avoid writing to other parts of the usb_device structure after it has been initialized. Similar changes should be made to the code that reads the BOS descriptor, but that can be handled in a separate patch later on. This patch is sufficient to fix the bug found by syzbot.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于USB模块中发现竞争条件问题。hub_port_init函数在初始化时可能会覆盖udev->descriptor，导致数据竞争。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 218925bfd5d1436e337c4f961e9c149fbe32de6d ~ 9d241c5d9a9b7ad95c90c6520272fe404d5ac88f -
Linux Linux 6.3 -

II. Public POCs for CVE-2023-52886

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-52886

请登录查看更多情报信息。

Other References for CVE-2023-52886 (6)

Same Patch Batch · Linux · 2024-07-16 · 98 CVEs total

CVE-2022-48851 9.8 CRITICAL staging: gdm724x: fix use after free in gdm_lte_rx()
CVE-2022-48788 9.8 CRITICAL nvme-rdma: fix possible use-after-free in transport error_recovery work
CVE-2022-48789 9.8 CRITICAL nvme-tcp: fix possible use-after-free in transport error_recovery work
CVE-2022-48790 9.8 CRITICAL nvme: fix a possible use-after-free in controller reset during load
CVE-2022-48829 9.1 CRITICAL NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
CVE-2022-48828 9.1 CRITICAL NFSD: Fix ia_size underflow
CVE-2022-48782 8.8 HIGH mctp: fix use after free
CVE-2022-48785 8.8 HIGH ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
CVE-2022-48830 8.8 HIGH can: isotp: fix potential CAN frame reception race in isotp_rcv()
CVE-2022-48864 8.8 HIGH vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
CVE-2022-48791 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted TMF sas_task
CVE-2022-48792 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
CVE-2022-48796 7.8 HIGH iommu: Fix potential use-after-free during probe
CVE-2022-48787 7.8 HIGH iwlwifi: fix use-after-free
CVE-2022-48786 7.8 HIGH vsock: remove vsock from connected table when connect is interrupted by a signal
CVE-2022-48847 7.8 HIGH watch_queue: Fix filter limit check
CVE-2022-48779 7.8 HIGH net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
CVE-2022-48821 7.8 HIGH misc: fastrpc: avoid double fput() on failed usercopy
CVE-2022-48801 7.8 HIGH iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
CVE-2022-48822 7.8 HIGH usb: f_fs: Fix use-after-free for epfile

Showing top 20 of 98 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-52886

No comments yet

Leave a comment