Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-41035— USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于在解析端点描述符时，假设保留位始终为0，这可能导致在检查重复项时错误地认为两个描述符是不同的端点。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.30% · P21

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 32

VendorProduct Version RangeStatus
Linux Linux 0a8fd1346254974c3a852338508e4a4cddbb35f1< d8418fd083d1b90a6c007cf8dcf81aeae274727b affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< 60abea505b726b38232a0ef410d2bd1994a77f78 affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< d09dd21bb5215d583ca9a1cb1464dbc77a7e88cf affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< 2bd8534a1b83c65702aec3cab164170f8e584188 affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< 9edcf317620d7c6a8354911b69b874cf89716646 affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< 647d61aef106dbed9c70447bcddbd4968e67ca64 affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< 37514a5c1251a8c5c95c323f55050736e7069ac7 affected
0a8fd1346254974c3a852338508e4a4cddbb35f1< a368ecde8a5055b627749b09c6218ef793043e47 affected
… +24 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-41035

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk). To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于在解析端点描述符时，假设保留位始终为0，这可能导致在检查重复项时错误地认为两个描述符是不同的端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0a8fd1346254974c3a852338508e4a4cddbb35f1 ~ d8418fd083d1b90a6c007cf8dcf81aeae274727b -
Linux Linux 4.10 -

II. Public POCs for CVE-2024-41035

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-41035

请登录查看更多情报信息。

Other References for CVE-2024-41035 (7)

Same Patch Batch · Linux · 2024-07-29 · 121 CVEs total

CVE-2024-41040 9.8 CRITICAL net/sched: Fix UAF when resolving a clash
CVE-2024-41081 9.8 CRITICAL ila: block BH in ila_output()
CVE-2024-41073 9.8 CRITICAL nvme: avoid double free special payload
CVE-2024-41091 8.8 HIGH tun: add missing verification for short frame
CVE-2024-41090 8.8 HIGH tap: add missing verification for short frame
CVE-2024-41046 8.8 HIGH net: ethernet: lantiq_etop: fix double free in detach
CVE-2024-42083 8.8 HIGH ionic: fix kernel panic due to multi-buffer handling
CVE-2024-41062 8.8 HIGH bluetooth/l2cap: sync sock recv cb and release
CVE-2024-41045 7.8 HIGH bpf: Defer work in bpf_timer_cancel_and_free
CVE-2024-41096 7.8 HIGH PCI/MSI: Fix UAF in msi_capability_init
CVE-2024-41049 7.8 HIGH filelock: fix potential use-after-free in posix_lock_inode
CVE-2024-41051 7.8 HIGH cachefiles: wait for ondemand_object_worker to finish when dropping object
CVE-2024-41057 7.8 HIGH cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
CVE-2024-41060 7.8 HIGH drm/radeon: check bo_va->bo is non-NULL before using it
CVE-2024-41059 7.8 HIGH hfsplus: fix uninit-value in copy_name
CVE-2024-41064 7.8 HIGH powerpc/eeh: avoid possible crash when edev->pdev changes
CVE-2024-42075 7.8 HIGH bpf: Fix remap of arena.
CVE-2024-42066 7.8 HIGH drm/xe: Fix potential integer overflow in page size calculation
CVE-2024-42064 7.8 HIGH drm/amd/display: Skip pipe if the pipe idx not set properly
CVE-2024-41086 7.8 HIGH bcachefs: Fix sb_field_downgrade validation

Showing top 20 of 121 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-41035

No comments yet

Leave a comment