Bug 1219832 (CVE-2024-25741)

Summary:	VUL-0: CVE-2024-25741: kernel: possible denial of service in printer_write in drivers/usb/gadget/function/f_printer.c
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	andrea.mattiazzo, kernel-bugs, mhocko, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/393677/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-25741:4.7:(AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	brutal proposal

Description SMASH SMASH 2024-02-12 13:04:39 UTC

printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-25741
https://www.cve.org/CVERecord?id=CVE-2024-25741
https://www.spinics.net/lists/linux-usb/msg252167.html

Comment 2 Oliver Neukum 2024-03-13 15:18:59 UTC

Created attachment 873480 [details]
brutal proposal

Comment 3 Oliver Neukum 2024-03-19 10:05:44 UTC

For the record:

Fix has been submitted to upstream, waiting for response

Comment 4 Andrea Mattiazzo 2024-03-28 09:49:25 UTC

Thanks for the patch Oliver.

Tracking as affected:
 - ALP-current
 - SLE15-SP5
 - SLE15-SP6
 - SLE15-SP6-GA
 - stable

Affected but CVSS<7:
 - SLE15-SP3-LTSS
 - SLE15-SP4-LTSS
 - cve/linux-5.14-LTSS

CONFIG_USB_F_PRINTER is configured only on codestreams after SLE15-SP3