CVE-2024-57993

What it actually does

Missing endpoint type validation in the hid-thrustmaster driver allows a type mismatch between USB pipe and transfer endpoint, triggering warnings during device probe.

Why it matters to the business

Low-risk driver instability or kernel warnings when using affected Thrustmaster devices; minimal operational disruption given stable low EPSS and no known exploitation campaigns.

How an attack unfolds

An attacker presents a crafted USB HID device that reaches the thrustmaster_probe function without proper endpoint checks, reproducing the pipe/endpoint type mismatch previously identified by syzbot.

How to fix it

Apply the upstream kernel fix that adds the endpoint type check. If using listed packages, update plone (PyPI) to version 4.0.

How to confirm the fix worked

Confirm the endpoint type validation is present in thrustmaster_probe after applying the patch; test with syzkaller or equivalent USB fuzzing tools.

Typical attack path

1. Connect a malicious or malformed USB HID device
2. Kernel loads hid-thrustmaster driver and calls probe
3. Endpoint type check is absent, causing pipe mismatch
4. Warning is emitted; potential follow-on instability

How to detect it

Review kernel logs for thrustmaster_probe warnings or USB pipe mismatch messages; no widespread exploitation artifacts expected given KEV status.

What your security team should do

• Prioritize kernel updates on systems exposing USB HID devices
• Monitor for similar endpoint validation issues in other HID drivers
• Apply plone (PyPI) 4.0 fixes where applicable