Endpoint Type Mismatch in HID Thrustmaster Driver - Linux Kernel Vulnerability
Summary
CVE-2024-57993: In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer e... Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware devices, including input devices like game controllers. The HID Thrustmaster driver is specifically designed to manage communication between Thrustmaster gaming peripherals and the Linux operating system. This driver is crucial for ensuring that these devices function correctly, allowing users to enjoy an optimal gaming experience. However, vulnerabilities in this driver can lead to system instability and security risks.
Vulnerability Detail
The vulnerability identified as CVE-2024-57993 arises from a type mismatch between a USB pipe and the transfer endpoint within the hid-thrustmaster driver. This issue can lead to warnings and potentially disrupt the normal operation of the driver, affecting the performance of connected Thrustmaster devices. The root cause of this vulnerability is a lack of proper checks for endpoint types, which has been a recurring issue in similar drivers. If exploited, this vulnerability may lead to unexpected behavior or crashes in the system, impacting user experience.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the hid-thrustmaster driver until the system is updated with the patched kernel. Additionally, users can monitor the USB devices connected to their system and ensure that only trusted devices are used to minimize potential risks.
Conclusion
CVE-2024-57993 is a critical vulnerability in the Linux kernel's hid-thrustmaster driver that can lead to system instability and performance issues with Thrustmaster devices. Users are advised to update their kernel to the latest version to mitigate this risk. For those unable to update immediately, temporary workarounds are available to minimize exposure.
See every vulnerability recorded for linux →
FAQ
CVE-2024-57993 is a vulnerability in the Linux kernel's hid-thrustmaster driver that results from a type mismatch between a USB pipe and the transfer endpoint.
This vulnerability can lead to warnings, system instability, and potentially crashes when using Thrustmaster gaming devices.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update your kernel right away, consider using alternative input devices or monitoring your USB connections to avoid potential issues.
More detailed information about CVE-2024-57993 can be found in the official Linux kernel documentation and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
