CVE-2024-45011

char: xillybus: Check USB endpoints when probing device

Description

In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Check USB endpoints when probing device Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type. All XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at address 1. This is verified in xillyusb_setup_base_eps(). On top of that, a XillyUSB device may have additional Bulk OUT endpoints. The information about these endpoints' addresses is deduced from a data structure (the IDT) that the driver fetches from the device while probing it. These endpoints are checked in setup_channels(). A XillyUSB device never has more than one IN endpoint, as all data towards the host is multiplexed in this single Bulk IN endpoint. This is why setup_channels() only checks OUT endpoints.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.06%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/25ee8b2908200fc862c0434e5ad483817d50ceda	patch
https://git.kernel.org/stable/c/4267131278f5cc98f8db31d035d64bdbbfe18658	patch
https://git.kernel.org/stable/c/5cff754692ad45d5086b75fef8cc3a99c30a1005	patch
https://git.kernel.org/stable/c/1371d32b95972d39c1e6e4bae8b6d0df1b573731	patch
https://git.kernel.org/stable/c/2374bf7558de915edc6ec8cb10ec3291dfab9594	patch

Frequently Asked Questions

What is the severity of CVE-2024-45011?: CVE-2024-45011 has been scored as a medium severity vulnerability.
How to fix CVE-2024-45011?: To fix CVE-2024-45011, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-45011 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-45011 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-45011?: CVE-2024-45011 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.