In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints<\/p>\n
In usb_enable_endpoint(), non-zero control endpoints (where
\nusb_endpoint_xfer_control(&ep->desc) is true) populate both
\ndev->ep_in[epnum] and dev->ep_out[epnum] with the same struct
\nusb_host_endpoint pointer.<\/p>\n
However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or
\ndev->ep_in[epnum] depending on the direction bit of epaddr when
\nreset_hardware is set, leaving the opposite direction’s array slot
\npointing to the disabled\/freed endpoint.<\/p>\n
Clear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a
\nnon-ep0 control endpoint with reset_hardware set, and update the
\nfunction kerneldoc accordingly.<\/p>\n
Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to
\nenumerate a USB device with a non-zero control endpoint
\n(bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL),
\nverifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when
\nthe interface is disabled.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints<\/p>\n
In usb_enable_endpoint(), non-zero control endpoints (where
\nu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41235","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}