Bug 1226474 (ZDI-24-778) - VUL-0: ZDI-24-778: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
Summary: VUL-0: ZDI-24-778: USB: core: Fix race by not overwriting udev->descriptor in...
Status: RESOLVED DUPLICATE of bug 1213123
Alias: ZDI-24-778
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Kernel Bugs
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/411018/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-18 09:51 UTC by SMASH SMASH
Modified: 2024-06-18 10:04 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-18 09:51:41 UTC 
This vulnerability allows physically present attackers to escalate privileges on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of USB descriptors. The issue results from the lack of proper validation of user-supplied data, which can result in a memory read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

Fixed in Linux 6.6-rc1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b

References:
https://www.zerodayinitiative.com/advisories/ZDI-24-778/
Comment 2 Andrea Mattiazzo 2024-06-18 10:04:34 UTC 
CVE-2023-37453 was assigned to the same fixing commit. Affected codestreams are already fixed.

*** This bug has been marked as a duplicate of bug 1213123 ***