CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of USB hub class requests, specifically in the `max3421_hub_control()` function, which fails to validate the `value` parameter before performing a left shift operation. This oversight can lead to shift-out-of-bounds behavior, allowing an attacker with access to the root hub to corrupt the `port_status`, potentially bypassing internal state checks and causing confusion in hub status reporting. Organizations using affected Linux kernel versions, particularly those managing USB devices, should prioritize addressing this vulnerability to mitigate risks associated with unauthorized access and system instability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_control()` function handles USB hub class requests to the virtual root hub. In the `default` branches of both the `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will exceed the width of `port_status`. So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status. Fix this by rejecting requests whose `value` exceeds the shift width before performing the shift. This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.