Bug 1226474 (ZDI-24-778)

Summary: VUL-0: ZDI-24-778: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Kernel Bugs <kernel-bugs>
Status: RESOLVED DUPLICATE QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: andrea.mattiazzo
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/411018/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-06-18 09:51:41 UTC 
This vulnerability allows physically present attackers to escalate privileges on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of USB descriptors. The issue results from the lack of proper validation of user-supplied data, which can result in a memory read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

Fixed in Linux 6.6-rc1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b

References:
https://www.zerodayinitiative.com/advisories/ZDI-24-778/
Comment 2 Andrea Mattiazzo 2024-06-18 10:04:34 UTC 
CVE-2023-37453 was assigned to the same fixing commit. Affected codestreams are already fixed.

*** This bug has been marked as a duplicate of bug 1213123 ***