USBIP Refcount Leak Vulnerability in Linux Kernel
Summary
GSD-2022-1004055: usb: usbip: fix a refcount leak in stub_probe(). Affects Kernel versions >= 3ff67445750a84de67faaf52c6e1895cb09f2c56, < 6bafee2f18af5e5ac125e42960bc65496d0e56a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. USBIP (USB over IP) is a kernel module that allows USB devices to be shared over a network. It enables remote access to USB devices as if they were connected locally. This vulnerability affects the USBIP module in the Linux Kernel.
Vulnerability Detail
The USBIP module in the Linux Kernel suffers from a refcount leak vulnerability in the stub_probe() function. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The issue arises due to improper handling of reference counts when probing USB devices. An attacker can trigger this vulnerability by sending specially crafted USBIP requests to a target system. Successful exploitation can lead to system instability or unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or update the Linux Kernel to mitigate the risk.
Conclusion
The USBIP refcount leak vulnerability in the Linux Kernel's stub_probe() function can lead to a denial-of-service condition or potential execution of arbitrary code with kernel privileges. It is crucial to update the Linux Kernel to version v4.9.318 or later to mitigate the risk. No known workarounds are available for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges. It may also result in system instability or unauthorized access to sensitive information.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your application's manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is crucial to update the Linux Kernel to the patched version.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is advisable to apply the patch promptly to mitigate any potential risks.
This vulnerability was discovered by an automated analysis tool and reported as part of the GSD (Global Security Database) project.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
