CVE-2024-46836

What it actually does

Missing bounds check on endpoint index in aspeed_udc USB gadget driver allows host-controlled index to reference past the endpoint array, enabling out-of-bounds memory access.

Why it matters to the business

Kernel-level flaw in USB device-side handling on affected Linux systems could lead to crashes, privilege escalation, or data exposure when connected to a malicious USB host; high downstream prevalence in embedded and server distributions increases patching urgency despite low observed exploitation.

How an attack unfolds

Attacker connects a malicious USB host to a vulnerable aspeed_udc gadget device, crafts control requests that supply an out-of-range endpoint index, and triggers array access beyond allocated bounds; listed threat actors in zero-day and kernel exploitation campaigns could leverage similar patterns though no public weaponization for this specific issue is recorded.

How to fix it

Update the Linux kernel to commit 31bd4fab49c0adc6228848357c1b1df9395858af or later; rebuild and deploy the fixed kernel image on all affected systems; for golang.org/x/net dependents apply version 0.0.0-20180925071336-cf3bd585ca2a where applicable.

How to confirm the fix worked

Confirm kernel source contains the endpoint index bounds check added in the referenced commit; run static analysis or fuzzing against the aspeed_udc driver; verify no out-of-bounds access occurs with crafted endpoint indices.

Typical attack path

1. Establish USB connection from attacker-controlled host to target gadget
2. Issue crafted USB control transfer setting endpoint index beyond array bounds
3. Trigger driver path that dereferences the invalid index
4. Achieve out-of-bounds read or write for further exploitation

How to detect it

Review kernel logs for USB gadget driver errors or oops related to endpoint handling; inspect USB traffic captures for anomalous control requests targeting endpoint indices; correlate with process crashes in usb gadget contexts.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using aspeed_udc
• Monitor EPSS and KEV status for any future rise in exploitability
• Restrict physical USB access on exposed devices until patched
• Incorporate endpoint validation tests into internal driver review processes