In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()<\/p>\n
The `max3421_hub_control()` function handles USB hub class requests
\nto the virtual root hub. In the `default` branches of both the
\n`ClearPortFeature` and `SetPortFeature` switch statements, it modifies
\n`max3421_hcd->port_status` by left shifting 1 by the request’s `value`
\nparameter. However, it does not validate whether this shift will exceed
\nthe width of `port_status`.<\/p>\n
So if a malicious userspace task with access to the root hub via
\n\/dev\/bus\/usb\/…\/001 issues a USBDEVFS_CONTROL ioctl with `wValue`
\ngreater than or equal to 32, the left shift operation invokes
\nshift-out-of-bounds undefined behavior. This results in arbitrary
\nbit corruption of `port_status`, including the normally-immutable
\nchange bits, which can bypass internal state checks and confuse the
\nhub status.<\/p>\n
Fix this by rejecting requests whose `value` exceeds the shift width
\nbefore performing the shift.<\/p>\n
This issue was found using a KLEE-based symbolic execution tool for
\nkernel drivers that I’m currently developing.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()<\/p>\n
The `max3421_hub_control()` function handles USB hub class re<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7155","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}