Bug 2348566 (CVE-2024-57993) - CVE-2024-57993 kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
Summary: CVE-2024-57993 kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_pro...
Keywords:
Status: NEW
Alias: CVE-2024-57993
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-27 03:03 UTC by OSIDB Bzimport
Modified: 2025-04-30 07:16 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-27 03:03:28 UTC 
In the Linux kernel, the following vulnerability has been resolved:

HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

syzbot has found a type mismatch between a USB pipe and the transfer
endpoint, which is triggered by the hid-thrustmaster driver[1].
There is a number of similar, already fixed issues [2].
In this case as in others, implementing check for endpoint type fixes the issue.

[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470
[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622
Comment 1 Michal Findra 2025-02-27 18:04:22 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022639-CVE-2024-57993-e136@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.