CVE-2023-53644

What it actually does

The radio-shark and radio-shark2 drivers submit USB bulk URBs without first verifying that the target endpoints exist and match the expected transfer type, resulting in invalid pipe/type combinations passed to usb_submit_urb and a kernel WARNING.

Why it matters to the business

Systems using the affected radio hardware may experience kernel warnings or stability issues when the driver is loaded with a non-conforming USB device; widespread kernel deployments increase exposure surface for local denial-of-service conditions.

How an attack unfolds

An attacker with local access attaches a USB device that the radio-shark driver binds to, then triggers driver initialization or register-write paths that submit URBs to endpoints the device does not actually provide, causing the USB core to emit a WARNING.

How to fix it

Upgrade to a kernel containing commit 3ed6a312ac1e7278f92b1b3d95377b335ae21e89; if the radio-shark hardware is not required, blacklist the radio-shark and radio-shark2 modules.

How to confirm the fix worked

Confirm the running kernel contains commit 3ed6a312ac1e7278f92b1b3d95377b335ae21e89 or later; inspect dmesg for absence of the 'BOGUS urb xfer' warning when a conforming device is attached.

Typical attack path

1. Obtain local access to a Linux system with the radio-shark driver enabled
2. Attach a USB device that matches the driver's VID/PID but lacks the expected endpoints
3. Trigger driver load or a register-write operation that calls shark_write_reg
4. usb_submit_urb receives mismatched pipe/type values and emits WARNING

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the strings 'BOGUS urb xfer' and 'usb_submit_urb' combined with radio-shark module activity; correlate with USB device attach events.

• BOGUS urb xfer, pipe
• WARNING: CPU.*usb_submit_urb
• shark_write_reg
• radio-shark2 driver

What your security team should do

• Apply the referenced kernel commit or distribution update containing the endpoint validation fix
• Blacklist the radio-shark and radio-shark2 modules on systems that do not require the hardware
• Monitor kernel logs for USB URB warnings during driver initialization