Linux Kernel Belkin USB Serial Driver Interrupt Status Length Validation Vulnerability

A vulnerability exists in the Belkin USB serial driver within the Linux kernel. The issue arises because the driver's interrupt callback misinterprets interrupt data as a four-byte status report, leading to potential out-of-bounds reads of status bytes. This flaw occurs because the interrupt-in buffer length is based on the endpoint's wMaxPacketSize, allowing short interrupt transfers to be processed incorrectly. The vulnerability has been addressed by adding a check for the actual length of the interrupt packet before parsing the status fields, ensuring that short transfers are ignored and do not cause invalid memory accesses. This vulnerability was reported using the Kernel Address Sanitizer (KASAN), which detected a slab-out-of-bounds error in the Belkin interrupt callback.

Impact

The vulnerability can lead to out-of-bounds memory access, potentially allowing for memory corruption or exploitation of other vulnerabilities that rely on such an access.

Reproduction

The vulnerability can be reproduced by sending a short interrupt transfer to a Belkin USB serial device. The driver will incorrectly process the transfer as a full four-byte status report, leading to an out-of-bounds read of the status bytes.

Remediation

Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed.