In the Linux kernel, the following vulnerability has been resolved:
net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
syzbot reported the following uninit-value access issue:
===================================================== BUG: KMSAN: uninit-value in smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] BUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 CPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Local variable ----buf.i87@smsc75xx_bind created at: __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482
This issue is caused because usbnet_read_cmd() reads less bytes than requested (zero byte in the reproducer). In this case, 'buf' is not properly filled.
This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads less bytes than requested.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-kvmUpgrade kernelUpgrade kernel-docUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-develUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-coreUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-rt-modules | Jun 6, 2024 | Mar 2, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade python-perfUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.198-187.748Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-livepatch-4.14.327-246.539Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64 | Aug 2, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel | May 13, 2024 | Mar 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Jun 3, 2024 | Mar 2, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel | Jul 1, 2024 | Mar 2, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-headersUpgrade python3-perfUpgrade perfUpgrade bpftoolUpgrade kernelUpgrade python-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-devel | Jul 23, 2024 | Mar 2, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Jul 17, 2024 | Mar 2, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Jun 6, 2024 | Mar 2, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jun 6, 2024 | Mar 2, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-cross-headersUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-coreUpgrade kernel-coreUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-rt-develUpgrade kernel-debugUpgrade kernel-rt-debug-modules | Jun 17, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-amlogicUpgrade kernel-docsUpgrade kernel-macrosUpgrade dtb-rockchipUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade kernel-azure-livepatch-develUpgrade dtb-xilinxUpgrade reiserfs-kmp-azureUpgrade kernel-obs-qaUpgrade dtb-sprdUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-64kb-extraUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade kernel-rt-extraUpgrade dtb-armUpgrade kernel-default-optionalUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rtUpgrade kernel-rt-livepatchUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-azure-vdsoUpgrade kernel-64kbUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade dtb-allwinnerUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade dtb-lgUpgrade dtb-appleUpgrade dtb-exynosUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-develUpgrade dtb-socionextUpgrade kernel-sourceUpgrade kernel-default-manUpgrade ocfs2-kmp-rtUpgrade dtb-marvellUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade kernel-source-vanillaUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade dlm-kmp-64kbUpgrade kernel-debugUpgrade dtb-amazonUpgrade reiserfs-kmp-64kbUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-alteraUpgrade dtb-freescaleUpgrade kernel-azure-baseUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-amdUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-default-livepatch-devel | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-4.4.0-1137-awsUpgrade linux-image-4.4.0-1138-kvmUpgrade linux-image-4.15.0-1136-oracleUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-oracleUpgrade linux-image-generic-lts-xenialUpgrade linux-image-oemUpgrade linux-image-aws-lts-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-virtualUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-gcpUpgrade linux-image-gkeUpgrade linux-image-4.15.0-1174-awsUpgrade linux-image-4.15.0-1182-azureUpgrade linux-image-4.15.0-230-lowlatencyUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-1157-kvmUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-260-genericUpgrade linux-image-4.15.0-230-genericUpgrade linux-image-4.4.0-1175-awsUpgrade linux-image-awsUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-260-lowlatencyUpgrade linux-image-4.15.0-1167-gcpUpgrade linux-image-azureUpgrade linux-image-lowlatency | Oct 17, 2024 | Mar 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub