Linux Kernel USBTMC Driver Interrupt Handling Vulnerability

A vulnerability has been identified in the Linux kernel USB Test and Measurement Class (USBTMC) driver, specifically in how it handles interrupt notifications from USBTMC devices. The driver fails to verify the presence of required two-byte header information before accessing data buffers. This oversight can lead to two potential issues: an out-of-bounds read, where the driver reads beyond the allocated buffer space, or the consumption of outdated data from a previous notification. The vulnerability arises when the actual length of the received data (URB actual_length) is insufficient to accommodate the headers, allowing for improper data handling and potential exploitation.

Impact

Exploitation of this vulnerability can cause out-of-bounds reads, which may lead to information disclosure or memory corruption.

Reproduction

To reproduce this vulnerability, connect a USBTMC device that utilizes an interrupt endpoint for notifications. The device should send interrupt-IN notifications with an actual length that does not include the required header bytes. The USBTMC driver will then either read past the end of the buffer or process stale data from a prior notification, demonstrating the lack of proper length validation.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched kernel can be found on the official Linux kernel website.