CVE-2022-48866

What it actually does

Missing validation of the actual number of endpoints in thrustmaster_probe allows slab-out-of-bounds read when usb_host_interface::endpoint array contains fewer entries than the driver expects.

Why it matters to the business

Local users or attached USB hardware can trigger kernel memory disclosure or crashes on affected Linux systems, leading to denial of service or limited information exposure; prevalence in kernel-dependent environments increases exposure surface.

How an attack unfolds

An attacker supplies a USB device whose interface descriptor reports fewer endpoints than the thrustmaster driver code assumes, causing the probe routine to read past the allocated endpoint array and access adjacent slab memory.

How to fix it

Update to a kernel containing the fix that adds the endpoint count validation check before accessing the array; apply the commit that resolves the missing validation in hid-thrustmaster.

How to confirm the fix worked

Confirm the updated kernel source contains the added endpoint count check and error message in thrustmaster_probe; test by connecting a device with mismatched endpoint count and verify no OOB access occurs.

Typical attack path

1. Attacker prepares a USB device or emulator that advertises a thrustmaster-compatible interface with an insufficient endpoint count.
2. Device is connected to the target system, triggering driver probe via USB hotplug or manual attachment.
3. thrustmaster_probe blindly indexes into the endpoint array without checking actual descriptor length.
4. Out-of-bounds read occurs, potentially disclosing kernel memory or causing a crash.

How to detect it

Review kernel logs for thrustmaster_probe errors mentioning endpoint count mismatch or slab-out-of-bounds reads; examine USB device descriptors from recently attached devices for unexpected endpoint counts.

What your security team should do

• Prioritize kernel updates on systems exposing USB HID devices to untrusted hardware.
• Monitor for thrustmaster-related oops or slab corruption events in kernel logs.
• Restrict unprivileged USB device attachment via policy where feasible.