CVE-2023-52742

What it actually does

Incorrect direction flag on a zero-length USB control-OUT transfer in the plusb driver causes usbnet_read_cmd to be called instead of usbnet_write_cmd, resulting in a mismatched bRequestType and a WARNING in usb_submit_urb.

Why it matters to the business

Systems using the affected USB network hardware may experience kernel warnings or driver instability during interface initialization; low exploitability and no known in-the-wild use limit operational risk, but kernel log noise and potential device bring-up failures can still occur on unpatched kernels.

How an attack unfolds

An attacker with local access triggers the network interface open path (for example via ifconfig or DHCP client), which invokes pl_reset; the erroneous usbnet_read_cmd call submits a control URB with the wrong direction bit, hitting the direction check in usb_submit_urb and generating the warning.

How to fix it

Apply the upstream fix by updating the Linux kernel to a version containing commit f0ad46ef772438c0596df370450d8bdc8a12dbfb or later; replace the call to usbnet_read_cmd with usbnet_write_cmd and remove the USB_DIR_IN flag in drivers/net/usb/plusb.c.

How to confirm the fix worked

Confirm the presence of the corrected pl_set_QuickLink_features function that calls usbnet_write_cmd without USB_DIR_IN; verify absence of the BOGUS control dir warning when bringing up a plusb device on the patched kernel.

Typical attack path

1. Local user or process opens the plusb network interface
2. dev_change_flags or equivalent calls usbnet_open
3. pl_reset issues pl_vendor_req using usbnet_read_cmd with USB_DIR_IN
4. usb_control_msg submits URB with mismatched direction
5. usb_submit_urb emits WARNING and may fail the transfer

How to detect it

Search kernel logs (dmesg, journalctl, /var/log/kern.log) for the string "BOGUS control dir" together with pipe 80000280 and bRequestType c0; correlate with process activity opening network interfaces on hosts that have the plusb module loaded.

• BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
• WARNING:.*usb_submit_urb.*drivers/usb/core/urb.c
• pl_reset.*plusb.c
• usb 1-1: BOGUS control dir

What your security team should do

• Identify hosts running kernels before f0ad46ef772438c0596df370450d8bdc8a12dbfb that load the plusb module
• Schedule kernel updates during the next maintenance window for any systems exposing the plusb driver
• Monitor kernel logs for the BOGUS control dir warning on remaining unpatched systems