USB Gadget f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
Summary
GSD-2022-1000190: usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS. Affects Kernel versions >= 4b289a0f3033f465b4fd51ba995251a7867a2aa2, < 3ca928c8242798c4d00cb3a30c20fa4a127ee6c7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USB Gadget f_sourcesink is a component of the Linux Kernel that provides support for USB functions in devices. It allows devices to act as USB peripherals and communicate with a host system. The f_sourcesink module specifically handles isochronous transfers, which are used for real-time data streaming. This vulnerability affects the f_sourcesink module when operating at USB_SPEED_SUPER_PLUS, a high-speed mode introduced in the Linux Kernel version 5.10.44.
Vulnerability Detail
The vulnerability in the USB Gadget f_sourcesink module at USB_SPEED_SUPER_PLUS mode can lead to potential security issues. The isoc transfer mechanism in this mode is flawed, which may result in data corruption, unauthorized access, or denial of service. Attackers could exploit this vulnerability to manipulate data streams, inject malicious code, or disrupt the functionality of the affected device. It is crucial to address this vulnerability promptly to ensure the integrity and security of USB communications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using USB_SPEED_SUPER_PLUS mode in the f_sourcesink module. By limiting the USB speed to lower modes, such as USB_SPEED_SUPER or USB_SPEED_HIGH, the vulnerability can be circumvented. However, this workaround may impact the performance of USB communications, and it is advisable to apply the permanent fix by updating the Linux Kernel as soon as possible.
Conclusion
The USB Gadget f_sourcesink vulnerability at USB_SPEED_SUPER_PLUS mode poses a significant security risk to devices utilizing this functionality. It is crucial to update the Linux Kernel to version 5.10.96 or later to address this vulnerability. In the meantime, users can apply a temporary workaround by avoiding USB_SPEED_SUPER_PLUS mode. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
USB_SPEED_SUPER_PLUS is a high-speed mode introduced in the Linux Kernel version 5.10.44. It provides faster data transfer rates compared to lower USB speed modes.
Attackers can exploit this vulnerability by manipulating data streams, injecting malicious code, or disrupting the functionality of the affected device. This can lead to data corruption, unauthorized access, or denial of service.
Yes, the vulnerability can be fixed by updating the Linux Kernel to version 5.10.96 or later. This update includes a commit that addresses the issue in the f_sourcesink module.
As a temporary workaround, users can avoid using USB_SPEED_SUPER_PLUS mode in the f_sourcesink module. By limiting the USB speed to lower modes, such as USB_SPEED_SUPER or USB_SPEED_HIGH, the vulnerability can be circumvented.
The potential risks of this vulnerability include data corruption, unauthorized access, and denial of service. Attackers could exploit the vulnerability to compromise the integrity and security of USB communications.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
