UNISOC Chipsets security vulnerabilities

UNISOC Chipsets is a chipset from China's Unisplendour UNISOC. A security vulnerability exists in UNISOC Chipsets, which stems from a lack of boundary checking in the UMTS RLC driver, which could result in out-of-bounds writes...

PT-2024-32502 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to an input validation vulnerability in the USB service module. Successful exploitation of this vulnerability may affect availability. Recommendations: At the moment,...

FreeBSD Hypervisor Code Execution

The vulnerability of the hypervisor in FreeBSD operating systems relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on a host using a virtual USB device connected to the XHCI interface...

kernel: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

A vulnerability was found in the usbparseendpoint function in the Linux kernel's usb drivers, where improper handling of the reserved bits in an endpoint descriptor's bEndpointAddress field can lead to confusion in the endpointisduplicate routine in config.c. This will erroneously treat the same...

kernel: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: prevent potential failure in handletxevent for Transfer events without TRB Some transfer events don't always point to a TRB, and consequently don't have a endpoint ring. In these cases, function handletxevent should no...

kernel: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

A flaw was found in the Linux kernel. This issue can cause a potential crash on the receiver USB disconnect...

kernel: USB: core: Make do_proc_control() and do_proc_bulk() killable

In the Linux kernel, the following vulnerability has been resolved: USB: core: Make doproccontrol and doprocbulk killable The USBDEVFSCONTROL and USBDEVFSBULK ioctls invoke usbstartwaiturb, which contains an uninterruptible wait with a user-specified timeout value. If timeout value is very large...

kernel: usb: atm: cxacru: fix endpoint checking in cxacru_bind()

A flaw was found in the Linux kernel's cxacru USB driver. Improper validation of USB communication endpoints during device connection allows an attacker capable of connecting or emulating a malicious USB device to supply unexpected endpoint configurations. This issue causes the driver to submit...

kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

A vulnerability was found in the Linux kernel's CDC WDM driver, where excessive logging in the interrupt-URB completion callback could lead to CPU lockups, which occurs when the driver rapidly resubmits interrupt URBs after receiving a -EPROTO status, causing a backlog of error messages that...

kernel: USB: core: Fix hang in usb_kill_urb by adding memory barriers

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix hang in usbkillurb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usbkillurb to return. It turns out the issue is not unlinking the URB; that works just fine...

kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

A vulnerability was found in the Linux kernel's CDC WDM driver, where excessive logging in the interrupt-URB completion callback could lead to CPU lockups, which occurs when the driver rapidly resubmits interrupt URBs after receiving a -EPROTO status, causing a backlog of error messages that...

kernel: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: prevent potential failure in handletxevent for Transfer events without TRB Some transfer events don't always point to a TRB, and consequently don't have a endpoint ring. In these cases, function handletxevent should no...

kernel: usb: atm: cxacru: fix endpoint checking in cxacru_bind()

A flaw was found in the Linux kernel's cxacru USB driver. Improper validation of USB communication endpoints during device connection allows an attacker capable of connecting or emulating a malicious USB device to supply unexpected endpoint configurations. This issue causes the driver to submit...

kernel: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

A flaw was found in the Linux kernel. This issue can cause a potential crash on the receiver USB disconnect...

kernel: Input: aiptek - properly check endpoint type

A wrong endpoint type warning was recorded in usbsubmiturb in the Linux kernel. This may present a potential loss of Availability...

USN-7007-3 linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2024-23848 Chenyuan Yang discovered that the USB Gadget subsystem in...

USN-7007-2 linux-ibm-5.15, linux-oracle-5.15 vulnerabilities

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2024-23848 Chenyuan Yang discovered that the USB Gadget subsystem in...

Sony XAV-AX5500 security vulnerabilities

The SONY XAV-AX5500 is a 7-inch in-vehicle center console with a wide range of functions and advanced technical features. The SONY XAV-AX5500 suffers from a buffer overflow vulnerability that originates from a constructed USB configuration descriptor that can trigger an overflow of a fixed-length...

OESA-2024-2153 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: net: USB: Fix wrong-direction WARNING in plusb.c The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as ...

OESA-2024-2150 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: media: aspeed: Fix memory overwrite if timing is 1600x900 When capturing 1600x900, system could crash when system memory usage is tight. The way to reproduce thi...