VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jun 19, 2024· Updated May 12, 2026

CVE-2024-38567

CVE-2024-38567

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: add a proper sanity check for endpoints

Syzkaller reports [1] hitting a warning which is caused by presence of a wrong endpoint type at the URB sumbitting stage. While there was a check for a specific 4th endpoint, since it can switch types between bulk and interrupt, other endpoints are trusted implicitly. Similar warning is triggered in a couple of other syzbot issues [2].

Fix the issue by doing a comprehensive check of all endpoints taking into account difference between high- and full-speed configuration.

[1] Syzkaller report: ... WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace:

carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

[2] Related syzkaller crashes:

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing endpoint sanity check in the carl9170 wireless driver could cause a kernel warning, fixed by adding comprehensive endpoint validation.

Vulnerability

Description The carl9170 wireless driver in the Linux kernel lacked a proper sanity check for USB endpoints, trusting endpoints implicitly. Syzkaller reports indicated a warning during URB submission due to wrong endpoint types, affecting both full-speed and high-speed configurations [1]. The issue occurs in the carl9170_usb_send_rx_irq_urb function.

Exploitation

An attacker with physical access to the USB port could insert a malicious device that presents crafted endpoint descriptors, causing the driver to submit an URB with incorrect endpoint type. No authentication is required beyond physical access, and the attack can be performed during device initialization.

Impact

The vulnerability triggers a kernel warning (WARNING: CPU: 0 PID: ... at drivers/usb/core/urb.c:504 usb_submit_urb), which can lead to a denial of service (system instability or crash). The fix adds comprehensive endpoint validation to prevent such warnings.

Mitigation

The fix was applied to the Linux kernel stable branches; users should update to latest versions. The Siemens advisory [1] lists affected products including SIMATIC S7-1500 TM MFP.

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

117

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.