CVE-2023-54277

Vulnerability

Overview In the Linux kernel's udlfb driver (fbdev/udlfb.c), a missing endpoint validation leads to a kernel warning and potential system crash. The driver only checked for the existence of a bulk-OUT endpoint, but did not verify that the endpoint it actually uses conforms to this type. This allows a malicious USB device to trigger a BOGUS urb xfer warning and a subsequent kernel BUG when usb_submit_urb() is called with mismatched endpoint parameters [1].

Exploitation

Conditions An attacker with physical access to the system can plug a malicious USB device that advertises a non-bulk-OUT endpoint (e.g., isochronous or interrupt) as the one the udlfb driver will use during probe. No authentication is required, and the attack can occur automatically via the USB hub event workqueue. The driver's dlfb_submit_urb() function is called during dlfb_set_video_mode(), which is invoked early in the probe sequence, leading to the crash [2].

Impact

Successful exploitation results in a kernel warning and a system crash (denial of service). The attacker gains no code execution or privilege escalation, but can cause repeated disruption by reconnecting the device. The issue affects all systems using the udlfb driver with vulnerable kernel versions prior to the patch [3].

Mitigation

The vulnerability is fixed in Linux kernel versions that include the commit which adds proper validation of the endpoint used by the driver, ensuring it exists and is of type bulk-OUT. Users should update to the latest stable kernel as soon as possible [1][2][3].