USB: core: Make do_proc_control() and do_proc_bulk() killable
Summary
GSD-2021-1002762: USB: core: Make do_proc_control() and do_proc_bulk() killable. Affects Kernel versions < 403716741c6c2c510dce44e88f085a740f535de6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USB core is a fundamental component of the Linux Kernel that provides support for USB devices. It handles various USB operations, including control and bulk transfers. The do_proc_control() and do_proc_bulk() functions are responsible for processing control and bulk transfer requests, respectively. These functions are critical for USB communication and are executed in the kernel space.
Vulnerability Detail
The do_proc_control() and do_proc_bulk() functions in the USB core were not killable, meaning that they could not be terminated by external signals. This vulnerability could be exploited by an attacker to cause a denial-of-service (DoS) condition by sending specially crafted USB requests that would trigger an infinite loop in these functions. This could lead to system instability or unresponsiveness, affecting the overall performance of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by applying the fix mentioned above.
Conclusion
The USB core vulnerability in the Linux Kernel, which made the do_proc_control() and do_proc_bulk() functions non-killable, has been addressed in the Linux Kernel version v5.15.11. Users are advised to update their Linux Kernel to the latest version to ensure the security of their systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to a denial-of-service (DoS) condition, causing system instability or unresponsiveness.
An attacker can exploit this vulnerability by sending specially crafted USB requests that trigger an infinite loop in the do_proc_control() and do_proc_bulk() functions.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.15.11.
To fix this vulnerability, users should update their Linux Kernel to version v5.15.11 or later.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by applying the fix mentioned above.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
