From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D2872E5412 for ; Tue, 7 Oct 2025 15:22:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759850563; cv=none; b=LQc3IzrU7DdJkxwSDCWLDS7XGn720Z0CDpAAM3IunI5+pkT4Cf8NfSpeKbwL4jd+4J6XIFW410+mf1mu5IKdnEI1Td2DSmwep08XNC83hYEHFTg17NmHNm4xEkxvARLWSDl15lU+BWfe+s3UV7CKDxxvDpxOersgZWlOnen2y7A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759850563; c=relaxed/simple; bh=wV784zynHy/HdIG8yBLPb3iwyaOGli60o2DU/9f6lL0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=JGlcwNKaMoQBpmp3gRrcwJU+M8zsLSYImmbjiDbHFZ0KJ8jYFgtGhFX11X1YAx7qwZgSPuOevJD0KPbUYlVmh3DSm8pdXsQNjck/nB3AI1N5U6tj2RyxAd3JkPVEfSEY7+cMBpx9VxrqMOPwbRBNszn+pxgCXeZyRC0/qn3NfPk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DqWwISTw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DqWwISTw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2ABDC4CEF1; Tue, 7 Oct 2025 15:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1759850563; bh=wV784zynHy/HdIG8yBLPb3iwyaOGli60o2DU/9f6lL0=; h=From:To:Cc:Subject:Date:Reply-to:From; b=DqWwISTwQ6+3/nBR/6rOvS2Gk6zCLR0Lbk8uciBzLjdPGzgt4fcIiannrXxJI90hB 2kqvd6Y1xyk5E4AhVHEC6YTwKMTtcqyKpdZaL/3Ng7X8xeDvuXAaf9NnDpl6fpIDKz diJZ7+DnIp5Iajr2a32MuUNVznGLAaszWDspb9hg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-53644: media: radio-shark: Add endpoint checks Date: Tue, 7 Oct 2025 17:19:49 +0200 Message-ID: <2025100717-CVE-2023-53644-efaa@gregkh> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4455; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ZZULT2t4D55zPqg3ZPQXUkicj+1N582R5J7Z2GX9A/A=; b=owGbwMvMwCRo6H6F97bub03G02pJDBlP9UsnJzkIXtrRus17bptk4Duhf2fM49aJTiquWNEly BlcbjS7I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZy7gvDgj6r+xz3xA79/XVm 8dzLT189S3iY6saw4HqJ9IJzGzm93dWtL3ocurRp/mwVCwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: media: radio-shark: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver). The Linux kernel CVE team has assigned CVE-2023-53644 to this issue. Affected and fixed versions =========================== Fixed in 4.14.316 with commit 3ed6a312ac1e7278f92b1b3d95377b335ae21e89 Fixed in 4.19.284 with commit afd72825b4fcb7ae4015e1c93b054f4c37a25684 Fixed in 5.4.244 with commit 2b580d0f03c4fc00013cd08f9ed96b87a08fd0d9 Fixed in 5.10.181 with commit 8a30dce9d7f70f8438956f6a01142b926c301334 Fixed in 5.15.114 with commit b1bde4b4360c3d8a35504443efabd3243b802805 Fixed in 6.1.31 with commit 53764a17f5d8f0d00b13297d06b5e65fa844288b Fixed in 6.3.5 with commit 4c3057a1927fa0b9ed8948b6f3b56b4ff9fa63d3 Fixed in 6.4 with commit 76e31045ba030e94e72105c01b2e98f543d175ac Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53644 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/radio/radio-shark.c drivers/media/radio/radio-shark2.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3ed6a312ac1e7278f92b1b3d95377b335ae21e89 https://git.kernel.org/stable/c/afd72825b4fcb7ae4015e1c93b054f4c37a25684 https://git.kernel.org/stable/c/2b580d0f03c4fc00013cd08f9ed96b87a08fd0d9 https://git.kernel.org/stable/c/8a30dce9d7f70f8438956f6a01142b926c301334 https://git.kernel.org/stable/c/b1bde4b4360c3d8a35504443efabd3243b802805 https://git.kernel.org/stable/c/53764a17f5d8f0d00b13297d06b5e65fa844288b https://git.kernel.org/stable/c/4c3057a1927fa0b9ed8948b6f3b56b4ff9fa63d3 https://git.kernel.org/stable/c/76e31045ba030e94e72105c01b2e98f543d175ac