Cyber Resilience

CVE-2024-27001

Linux Kernel 3.9 – 4.19.313

Published
01 May 2024
Modified
23 December 2025
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0028 20th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-27001 is a medium-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk…

more

or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them. Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present. This patch has not been tested on real hardware. [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399 ... Similar issue also found by Syzkaller:

CWE(s)

Related Threats

CVEs Like This One

CVE-2024-26994Same product: Debian Debian Linux
CVE-2024-27401Same product: Debian Debian Linux
CVE-2024-26988Same product: Debian Debian Linux
CVE-2024-27000Same product: Debian Debian Linux
CVE-2024-27398Same product: Debian Debian Linux
CVE-2023-6270Same product: Debian Debian Linux
CVE-2024-27008Same product: Debian Debian Linux
CVE-2024-27004Same product: Debian Debian Linux
CVE-2023-46838Same product: Debian Debian Linux
CVE-2024-27399Same product: Debian Debian Linux

Affected Assets

linux
linux kernel
6.9 · 3.9 — 4.19.313 · 4.20 — 5.4.275 · 5.5 — 5.10.216
debian
debian linux
10.0
fedoraproject
fedora
38, 39, 40

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References