CVE-2023-53185

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTC_CTRL_RSVD_SVC and should not be modified to be used for any other services.

Reject such service connection responses.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

This vulnerability is rated Moderate rather than Important because exploitation requires physical access to plug in a malicious USB device, or direct access to attach an emulated USB device to a virtualized guest. The affected ath9k_htc driver is not loaded by default on Red Hat Enterprise Linux systems unless specific Atheros USB Wi-Fi hardware is connected. As a result, standard enterprise deployments and virtualized environments without USB passthrough face minimal exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.