CVE-2022-48834

usb: usbtmc: Fix bug in pipe direction for control transfers

HIGH

7.8

CVSS Score

Published: July 16, 2024 at 12:25 PM UTC

Updated: June 17, 2026 at 05:16 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Fix bug in pipe direction for control transfers The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline] The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.20 ≤ v < 5.10.1084.20 ≤ v < 5.15.314.20 ≤ v < 5.16.174.20 ≤ v < 5.174.20 ≤ v < 5.4.1875.11 ≤ v < 5.15.315.16 ≤ v < 5.16.175.5 ≤ v < 5.10.1085.17 rc1 5.17 rc2 5.17 rc3 5.17 rc4 5.17 rc5 5.17 rc6 5.17 rc7 5.17 rc8658f24f4523e41cda6a389c38b763f4c0cad6fbc

Vendor states this is fixed in 10a805334a11acd547602d6c4cf540a0f6ab5c6e (fixed)

Vendor states this is fixed in 5f6a2d63c68c12cf61259df7c3527a0e05dce952 (fixed)

Vendor states this is fixed in 700a0715854c1e79a73341724ce4f5bb01abc016 (fixed)

Vendor states this is fixed in c69aef9db878ab277068a8cc1b4bf0cf309dc2b7 (fixed)

Vendor states this is fixed in e9b667a82cdcfe21d590344447d65daed52b353b (fixed)

Vendor states this is fixed in 4.20 (unaffected)

Vendor states this is fixed in 5.10.108 (unaffected)

Vendor states this is fixed in 5.15.31 (unaffected)

Vendor states this is fixed in 5.16.17 (unaffected)

Vendor states this is fixed in 5.17 (unaffected)

Vendor states this is fixed in 5.4.187 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references