CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's igorplugusb driver, where an incorrect handling of control request setup packets can lead to improper interpretation of USB control requests. This flaw may result in invalid control direction warnings and could potentially allow for unexpected behavior or exploitation in USB communications. Organizations utilizing Linux systems with this driver should prioritize addressing this issue to mitigate potential risks associated with USB device interactions.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet.
Related CVEs
Other vulnerabilities affecting the same vendor(s)