CVE-2022-48834

What it actually does

The usbtmc driver incorrectly uses usb_rcvctrlpipe() for all control transfers in usbtmc_ioctl_request regardless of direction, causing URB submission with mismatched pipe and bRequestType that triggers warnings and potential improper input validation during USB control message handling.

Why it matters to the business

Local users on systems with the usbtmc driver loaded can trigger kernel warnings or exploit the direction mismatch for elevated impact on USB test and measurement devices; high ecosystem prevalence of the Linux kernel increases exposure for embedded and desktop deployments until patched.

How an attack unfolds

An attacker with local access loads or interacts with the usbtmc driver, issues crafted ioctl requests that force control transfers in the wrong direction, and leverages the resulting bogus pipe state to achieve memory corruption or code execution; the listed Android kernel threat actor context is not applicable to this USB TMC-specific flaw.

How to fix it

Update the Linux kernel to the fixed commit 700a0715854c1e79a73341724ce4f5bb01abc016 or later stable releases containing the pipe direction correction in drivers/usb/class/usbtmc.c.

How to confirm the fix worked

Confirm the usbtmc.c source contains the corrected direction logic for usb_rcvctrlpipe vs usb_sndctrlpipe usage, rebuild the kernel, and test that no BOGUS control dir warnings appear under syzkaller-style fuzzing of usbtmc ioctls.

Typical attack path

1. Obtain local user access on a Linux system with usbtmc driver enabled
2. Open /dev/usbtmc device and invoke usbtmc_ioctl_request with mismatched IN/OUT control parameters
3. Trigger usb_control_msg submission using always-receive pipe
4. Cause URB mismatch warning or exploit resulting improper validation for privilege escalation

How to detect it

Search kernel logs and dmesg for 'BOGUS control dir' and 'usb_submit_urb' warnings originating from usbtmc_ioctl_request; examine audit logs for unusual ioctl activity on usbtmc character devices.

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit on all systems exposing usbtmc devices
• Restrict local access to /dev/usbtmc nodes via udev rules until patched
• Monitor kernel logs for usb_submit_urb warnings related to usbtmc
• Audit downstream dependents for custom usbtmc usage and schedule testing