CVE-2022-48834

usb: usbtmc: Fix bug in pipe direction for control transfers

State: Published
Severity: Not scored
Published: Jul 16, 2024
Updated: May 11, 2026
Reserved: Jul 16, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: Fix bug in pipe direction for control transfers

The syzbot fuzzer reported a minor bug in the usbtmc driver:

usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline]

The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	658f24f4523e41cda6a389c38b763f4c0cad6fbc to before 700a0715854c1e79a73341724ce4f5bb01abc016Affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc to before 10a805334a11acd547602d6c4cf540a0f6ab5c6eAffected 658f24f4523e41cda6a389c38b763f4c0cad6fbc to before c69aef9db878ab277068a8cc1b4bf0cf309dc2b7Affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc to before 5f6a2d63c68c12cf61259df7c3527a0e05dce952Affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc to before e9b667a82cdcfe21d590344447d65daed52b353bAffected
LinuxLinux	4.20Affected before 4.20Not affected 5.4.187 through 5.4.Not affected 5.10.108 through 5.10.Not affected 5.15.31 through 5.15.Not affected 5.16.17 through 5.16.Not affected 5.17 and laterNot affected

Product

Versions

LinuxLinux

658f24f4523e41cda6a389c38b763f4c0cad6fbc to before 700a0715854c1e79a73341724ce4f5bb01abc016Affected
658f24f4523e41cda6a389c38b763f4c0cad6fbc to before 10a805334a11acd547602d6c4cf540a0f6ab5c6eAffected
658f24f4523e41cda6a389c38b763f4c0cad6fbc to before c69aef9db878ab277068a8cc1b4bf0cf309dc2b7Affected
658f24f4523e41cda6a389c38b763f4c0cad6fbc to before 5f6a2d63c68c12cf61259df7c3527a0e05dce952Affected
658f24f4523e41cda6a389c38b763f4c0cad6fbc to before e9b667a82cdcfe21d590344447d65daed52b353bAffected

LinuxLinux

4.20Affected
before 4.20Not affected
5.4.187 through 5.4.*Not affected
5.10.108 through 5.10.*Not affected
5.15.31 through 5.15.*Not affected
5.16.17 through 5.16.*Not affected
5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.