USB Gadget f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
Summary
GSD-2022-1000615: usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS. Affects Kernel versions >= 90c4d05780d47e14a50e11a7f17373104cd47d25, < 103938dd5798e150689362290274b87af54e3a52. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USB Gadget f_sourcesink is a component of the Linux Kernel that provides support for USB functions in devices. It allows devices to act as USB gadgets, enabling them to function as USB devices when connected to a host. The f_sourcesink module specifically handles isochronous transfers, which are used for real-time data streaming. This vulnerability affects the f_sourcesink module when used with USB_SPEED_SUPER_PLUS, a high-speed USB mode introduced in the Linux Kernel version 5.13.
Vulnerability Detail
The vulnerability in the f_sourcesink module for USB_SPEED_SUPER_PLUS can lead to potential security issues. The isochronous transfer mechanism in this mode is not properly implemented, which may result in data corruption or other unexpected behavior. Attackers could potentially exploit this vulnerability to manipulate or intercept data being transferred over USB connections, compromising the integrity and confidentiality of the data. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using USB_SPEED_SUPER_PLUS mode until the Kernel is updated. This can be achieved by configuring USB devices to operate in lower-speed modes, such as USB_SPEED_SUPER or USB_SPEED_HIGH. However, this workaround may limit the device's performance capabilities.
Conclusion
The USB Gadget f_sourcesink vulnerability in the Linux Kernel for USB_SPEED_SUPER_PLUS can potentially lead to data corruption and unauthorized access. It is crucial to update the Kernel to version 5.16.5 or later to fix this vulnerability. Until the update is applied, users can mitigate the risk by avoiding the use of USB_SPEED_SUPER_PLUS mode. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The USB Gadget f_sourcesink module is a component of the Linux Kernel that enables devices to function as USB gadgets. It provides support for USB functions and handles isochronous transfers for real-time data streaming.
USB_SPEED_SUPER_PLUS is a high-speed USB mode introduced in the Linux Kernel version 5.13. It offers faster data transfer rates compared to lower-speed modes like USB_SPEED_SUPER or USB_SPEED_HIGH.
Isochronous transfers are a type of USB transfer used for real-time data streaming. They provide a continuous stream of data with a guaranteed bandwidth, making them suitable for applications that require real-time synchronization, such as audio and video streaming.
This vulnerability could lead to data corruption or unauthorized access to data transferred over USB connections. Attackers may be able to manipulate or intercept the data, compromising its integrity and confidentiality.
Until the Kernel is updated, you can mitigate the risk by avoiding the use of USB_SPEED_SUPER_PLUS mode. Configure USB devices to operate in lower-speed modes like USB_SPEED_SUPER or USB_SPEED_HIGH.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
