CVE-2022-48834
usb: usbtmc: Fix bug in pipe direction for control transfers
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Fix bug in pipe direction for control transfers The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline] The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc – < 700a0715854c1e79a73341724ce4f5bb01abc016
- affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc – < 10a805334a11acd547602d6c4cf540a0f6ab5c6e
- affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc – < c69aef9db878ab277068a8cc1b4bf0cf309dc2b7
- affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc – < 5f6a2d63c68c12cf61259df7c3527a0e05dce952
- affected 658f24f4523e41cda6a389c38b763f4c0cad6fbc – < e9b667a82cdcfe21d590344447d65daed52b353b
- affected 4.20
- unaffected < 4.20
- unaffected 5.4.187 – ≤ 5.4.*
- unaffected 5.10.108 – ≤ 5.10.*
- unaffected 5.15.31 – ≤ 5.15.*
- unaffected 5.16.17 – ≤ 5.16.*
- unaffected 5.17 – ≤ *
References (5)
- https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-48834)Record last updated .