CVE-2022-3577 Overview
CVE-2022-3577 is an out-of-bounds memory write vulnerability in the Linux kernel's Kid-friendly Wired Controller driver (hid-bigbenff). The flaw resides in the bigben_probe function of drivers/hid/hid-bigbenff.c. The driver incorrectly assumes that all BigBen devices expose at least one input. A crafted or malicious USB Human Interface Device (HID) that violates this assumption triggers an out-of-bounds write during probe.
A local attacker who can attach a malicious HID device can crash the kernel or potentially escalate privileges on the affected system. The weakness is classified under [CWE-787] (Out-of-bounds Write) and [CWE-401] (Missing Release of Memory after Effective Lifetime).
Critical Impact
A local attacker presenting a malicious HID device can trigger an out-of-bounds kernel write, leading to denial of service or local privilege escalation to root.
Affected Products
- Linux Kernel (multiple stable branches prior to fix)
- Linux Kernel 5.19-rc1
- Distributions shipping the hid-bigbenff driver without the upstream patch
Discovery Timeline
- 2022-10-20 - CVE-2022-3577 published to the National Vulnerability Database (NVD)
- 2025-05-08 - Last updated in the NVD database
Technical Details for CVE-2022-3577
Vulnerability Analysis
The hid-bigbenff driver supports BigBen Interactive Kid-friendly wired game controllers over USB HID. During device initialization, bigben_probe accesses the device's input list without first verifying that the device actually reports any input. The function assumes the input list is non-empty because legitimate BigBen hardware always advertises at least one input collection.
When the kernel encounters a malicious or malformed HID device that declares the BigBen vendor and product identifiers but exposes no inputs, the probe routine dereferences and writes beyond the bounds of the expected structure. The result is corruption of adjacent kernel memory.
Because the vulnerable path executes in kernel context with full privileges, a successful write can be steered into critical kernel data structures. This enables an attacker with physical access, or with the ability to load a USB gadget profile from an unprivileged container or virtual machine, to crash the host or hijack kernel control flow.
Root Cause
The root cause is an unchecked assumption about device-supplied descriptors. bigben_probe trusts the HID report layout instead of validating that the parsed input list contains at least one entry. The driver also fails to release allocated resources on the error path, which is the basis for the secondary [CWE-401] memory leak classification.
Attack Vector
Exploitation requires local access. An attacker connects a USB device, or emulates one using a programmable peripheral such as a Raspberry Pi Zero running USB gadget mode, that spoofs the BigBen vendor and product IDs while omitting input collections. When the kernel binds the device to hid-bigbenff, the probe routine performs the out-of-bounds write. Exploitation does not require user interaction beyond plugging in the device.
No public proof-of-concept code is available. The vulnerability mechanism is described in the upstream commits referenced in the Linus Torvalds kernel tree fix and the follow-up cleanup commit.
Detection Methods for CVE-2022-3577
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing bigben_probe or hid-bigbenff in dmesg and /var/log/kern.log
- USB connection events for HID devices reporting BigBen vendor identifiers on systems where such controllers are not deployed
- Unexplained reboots or kernel crashes shortly after USB device insertion
Detection Strategies
- Audit running kernel versions across the fleet and compare against the patched commits in the upstream char-misc and mainline trees
- Monitor kernel ring buffer messages for HID driver faults using a log forwarder feeding into a SIEM
- Correlate USB device insertion events from udev with subsequent kernel error signatures to identify suspicious HID enumerations
Monitoring Recommendations
- Forward auditd USB device events and kernel logs to a centralized analytics platform for retrospective analysis
- Alert on repeated HID probe failures originating from the same hardware port
- Track endpoint kernel versions in asset inventory and flag hosts missing the upstream fix
How to Mitigate CVE-2022-3577
Immediate Actions Required
- Update the Linux kernel to a version that includes the upstream fix for hid-bigbenff
- Apply distribution security updates from the relevant vendor channels as soon as they are available
- Restrict physical access to production systems and disable unused USB ports on servers and kiosks
Patch Information
The issue is resolved upstream in the following commits: 945a9a8e448b, fc4ef9d57249, and the char-misc tree backport. The fix validates that the BigBen device reports at least one input before dereferencing the input list and corrects the resource cleanup path.
Workarounds
- Blacklist the hid-bigbenff kernel module on systems that do not require BigBen controller support
- Apply USB device authorization policies via usbguard to permit only known-good HID devices
- Disable USB autosuspend and autoload of unused HID drivers through modprobe configuration
# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist hid-bigbenff" | sudo tee /etc/modprobe.d/blacklist-bigbenff.conf
sudo depmod -a
sudo update-initramfs -u
# Optional: enforce USB device allowlisting with usbguard
sudo apt install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
