Linux Kernel MCT U232 USB Serial Driver Memory Corruption Vulnerability

A memory corruption vulnerability has been identified in the Linux kernel's USB serial MCT U232 driver. This issue arises because the driver improperly overrides the maximum transfer size for devices that only accept 16-byte packets on their 32-byte bulk-out endpoints. The vulnerability can lead to slab corruption if a malicious device reports a smaller endpoint maximum packet size than expected.

Impact

Exploitation of this vulnerability can cause memory corruption, specifically slab corruption, which can lead to various memory-related issues, including potential arbitrary code execution or causing a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by using a Sitecom U232-P25 device with the Linux kernel USB serial MCT U232 driver. The device will report a maximum output packet size of 32 bytes, but it can only accept 16 bytes. When the driver increases the transfer size to 32 bytes, it creates a mismatch that can be exploited by a malicious device.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux kernel documentation.