USN-7089-3: Linux kernel vulnerabilities

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux
kernel did not properly check for the device to be enabled before
writing. A local attacker could possibly use this to cause a denial of
service. (CVE-2024-25741)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- MIPS architecture;
- PA-RISC architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Cryptographic API;
- Serial ATA and Parallel ATA drivers;
- Null block device driver;
- Bluetooth drivers;
- Cdrom driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- CXL (Compute Express Link) drivers;
- Cirrus firmware drivers;
- GPIO subsystem;
- GPU drivers;
- I2C subsystem;
- IIO subsystem;
- InfiniBand drivers;
- ISDN/mISDN subsystem;
- LED subsystem;
- Multiple devices driver;
- Media drivers;
- Fastrpc Driver;
- Network drivers;
- Microsoft Azure Network Adapter (MANA) driver;
- Near Field Communication (NFC) drivers;
- NVME drivers;
- NVMEM (Non Volatile Memory) drivers;
- PCI subsystem;
- Pin controllers subsystem;
- x86 platform drivers;
- S/390 drivers;
- SCSI drivers;
- Thermal drivers;
- TTY drivers;
- UFS subsystem;
- USB DSL drivers;
- USB core drivers;
- DesignWare USB3 driver;
- USB Gadget drivers;
- USB Serial drivers;
- VFIO drivers;
- VHOST drivers;
- File systems infrastructure;
- BTRFS file system;
- GFS2 file system;
- JFFS2 file system;
- JFS file system;
- Network file systems library;
- Network file system client;
- NILFS2 file system;
- NTFS3 file system;
- SMB network file system;
- Memory management;
- Netfilter;
- Tracing infrastructure;
- io_uring subsystem;
- BPF subsystem;
- Core kernel;
- Bluetooth subsystem;
- CAN network layer;
- Ceph Core library;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- MAC80211 subsystem;
- Network traffic control;
- Sun RPC protocol;
- Wireless networking;
- AMD SoC Alsa drivers;
- SoC Audio for Freescale CPUs drivers;
- MediaTek ASoC drivers;
- SoC audio core drivers;
- SOF drivers;
- Sound sequencer drivers;
(CVE-2024-42239, CVE-2024-42079, CVE-2024-41080, CVE-2024-42064,
CVE-2024-42127, CVE-2024-41049, CVE-2024-41086, CVE-2024-42142,
CVE-2024-42244, CVE-2024-41060, CVE-2024-42131, CVE-2024-42085,
CVE-2024-42246, CVE-2024-41062, CVE-2024-42115, CVE-2024-42234,
CVE-2024-42080, CVE-2024-41095, CVE-2024-41063, CVE-2024-42227,
CVE-2024-41089, CVE-2024-42133, CVE-2024-43858, CVE-2024-42135,
CVE-2024-42113, CVE-2024-42120, CVE-2024-42149, CVE-2024-42132,
CVE-2024-41038, CVE-2024-41069, CVE-2024-41090, CVE-2024-41059,
CVE-2024-41028, CVE-2024-42126, CVE-2024-42121, CVE-2024-42155,
CVE-2024-42110, CVE-2024-41021, CVE-2024-41044, CVE-2024-42098,
CVE-2024-42235, CVE-2024-41083, CVE-2024-41065, CVE-2024-42094,
CVE-2024-42229, CVE-2024-42240, CVE-2024-42225, CVE-2024-42230,
CVE-2024-41088, CVE-2024-42073, CVE-2024-42145, CVE-2024-42076,
CVE-2024-42087, CVE-2024-42241, CVE-2024-41019, CVE-2024-41052,
CVE-2024-42093, CVE-2024-42063, CVE-2024-41039, CVE-2024-42106,
CVE-2024-42108, CVE-2024-42237, CVE-2024-41048, CVE-2024-41033,
CVE-2023-52888, CVE-2024-41096, CVE-2024-41032, CVE-2024-41091,
CVE-2024-42238, CVE-2024-41056, CVE-2024-42091, CVE-2024-42088,
CVE-2024-41047, CVE-2024-42271, CVE-2024-41064, CVE-2024-42223,
CVE-2024-42129, CVE-2024-42102, CVE-2024-42146, CVE-2024-42138,
CVE-2024-41079, CVE-2024-42232, CVE-2024-42112, CVE-2024-39487,
CVE-2024-42245, CVE-2024-41093, CVE-2024-41066, CVE-2024-43855,
CVE-2024-41055, CVE-2024-42100, CVE-2024-41053, CVE-2024-42069,
CVE-2024-42252, CVE-2024-42243, CVE-2024-42124, CVE-2024-41054,
CVE-2024-42151, CVE-2024-42118, CVE-2024-42251, CVE-2024-42137,
CVE-2024-41071, CVE-2024-41010, CVE-2024-41087, CVE-2024-41050,
CVE-2024-42068, CVE-2024-42158, CVE-2024-41075, CVE-2024-42141,
CVE-2024-42236, CVE-2024-41068, CVE-2024-42157, CVE-2024-42140,
CVE-2024-41058, CVE-2024-41076, CVE-2024-42097, CVE-2024-41029,
CVE-2024-41097, CVE-2024-42109, CVE-2024-41051, CVE-2024-41061,
CVE-2024-42156, CVE-2024-42101, CVE-2024-41031, CVE-2024-41017,
CVE-2024-42247, CVE-2024-42128, CVE-2024-41085, CVE-2024-41072,
CVE-2024-42248, CVE-2024-41045, CVE-2024-42104, CVE-2024-42253,
CVE-2024-42117, CVE-2024-41078, CVE-2024-42130, CVE-2024-42090,
CVE-2024-42280, CVE-2024-42250, CVE-2024-42231, CVE-2024-41042,
CVE-2024-42077, CVE-2024-42153, CVE-2024-41015, CVE-2024-41035,
CVE-2024-41082, CVE-2024-42114, CVE-2024-41007, CVE-2024-41073,
CVE-2024-42161, CVE-2024-42082, CVE-2024-42150, CVE-2024-42111,
CVE-2024-42086, CVE-2024-42095, CVE-2024-41025, CVE-2024-41081,
CVE-2024-42105, CVE-2024-41027, CVE-2024-42089, CVE-2024-39486,
CVE-2024-41084, CVE-2024-42092, CVE-2024-42152, CVE-2024-41022,
CVE-2024-41077, CVE-2024-41098, CVE-2024-41023, CVE-2024-42066,
CVE-2024-41034, CVE-2024-41037, CVE-2024-41046, CVE-2023-52887,
CVE-2024-42147, CVE-2024-42065, CVE-2024-42096, CVE-2024-41018,
CVE-2024-42067, CVE-2024-41041, CVE-2024-42103, CVE-2024-42084,
CVE-2024-42074, CVE-2024-41094, CVE-2024-42119, CVE-2024-41012,
CVE-2024-41020, CVE-2024-41074, CVE-2024-42144, CVE-2024-41067,
CVE-2024-42070, CVE-2024-41057, CVE-2024-41036, CVE-2024-42136,
CVE-2024-41030, CVE-2024-41070, CVE-2024-41092)

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - USN-7089-3: Linux kernel vulnerabilities
id: 12edc62d-a10b-4456-a43b-1af08801a2da
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'CVE-2024-41071'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - cve.2024-41071

rule CTI_CVE_2024_41071 {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for CVE-2024-41071"
    strings:
        $cve = "CVE-2024-41071" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("CVE-2024-41071" OR CommandLine="*CVE-2024-41071*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

vulnerability.id: "CVE-2024-41071" or message: "*CVE-2024-41071*"

CommonSecurityLog
| where AdditionalExtensions has "CVE-2024-41071" or Message has "CVE-2024-41071"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

#!/usr/bin/env bash
# ==============================================================================
# iShareStuff CTI Fleet Remediation Automation
# Advisory Reference : CVE-2024-41071
# Target Ecosystem    : Generic Systems
# Generated Timestamp : 2026-09-26 08:10:00 UTC
# Execution Context   : Run as root / privileged administrator
# ==============================================================================

set -euo pipefail
IFS=$'\n\t'

echo "[+] Starting automated remediation for advisory: CVE-2024-41071"
echo "[*] Detecting target host package manager..."

if command -v apt-get >/dev/null 2>&1; then
    echo "[*] Debian/Ubuntu detected. Refreshing APT cache and patching security updates..."
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get --only-upgrade install -y -qq unattended-upgrades
    unattended-upgrade -d || apt-get dist-upgrade -y -qq
    echo "[✔] Debian/Ubuntu security mitigation complete."
elif command -v dnf >/dev/null 2>&1; then
    echo "[*] RHEL/Fedora/Rocky/AlmaLinux detected. Applying security advisories via DNF..."
    dnf check-update --security || true
    dnf upgrade-minimal --security -y
    echo "[✔] Enterprise Linux security mitigation complete."
elif command -v zypper >/dev/null 2>&1; then
    echo "[*] SUSE/openSUSE detected. Applying security patches via Zypper..."
    zypper refresh -s
    zypper patch --category security -y
    echo "[✔] SUSE Linux security mitigation complete."
elif command -v apk >/dev/null 2>&1; then
    echo "[*] Alpine Linux detected. Upgrading base security packages..."
    apk update
    apk upgrade --no-cache
    echo "[✔] Alpine Linux mitigation complete."
else
    echo "[-] Unknown package manager. Please verify vendor patches manually for CVE-2024-41071." >&2
    exit 1
fi

echo "[✔] Remediation procedure for CVE-2024-41071 executed successfully."
exit 0

<#
.SYNOPSIS
    iShareStuff CTI Fleet Remediation Automation for CVE-2024-41071
.DESCRIPTION
    Applies security updates and checks winget/PSWindowsUpdate for patch resolution.
    Target: Windows Fleet | Generated: 2026-09-26 08:10:00 UTC
#>

#Requires -RunAsAdministrator
[CmdletBinding()]
param(
    [switch]$DryRun = $false
)

Write-Host "[+] Initiating Fleet Security Patch for CVE-2024-41071..." -ForegroundColor Cyan

# 1. Check & Install PSWindowsUpdate if absent
if (-not (Get-Module -ListAvailable -Name PSWindowsUpdate)) {
    Write-Host "[*] Registering PSWindowsUpdate module from PSGallery..." -ForegroundColor Yellow
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
    Install-Module -Name PSWindowsUpdate -Force -Confirm:$false | Out-Null
}

# 2. Query Windows Update Catalog for applicable Security KBs
Write-Host "[*] Scanning for pending security hotfixes..." -ForegroundColor Gray
Import-Module PSWindowsUpdate -Force

if ($DryRun) {
    Get-WUList -MicrosoftUpdate
    Write-Host "[!] DryRun active: No changes applied." -ForegroundColor Yellow
    exit 0
}

# 3. Apply Security KBs without uncontrolled reboot
try {
    Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot -Verbose
    Write-Host "[✔] Windows Update security rollups successfully deployed." -ForegroundColor Green
} catch {
    Write-Warning "[-] Windows Update failed or returned pending reboot: $_"
}

# 4. Optional Winget Userland Upgrade Check
if (Get-Command winget.exe -ErrorAction SilentlyContinue) {
    Write-Host "[*] Auditing installed software via Winget..." -ForegroundColor Gray
    winget upgrade --all --accept-package-agreements --accept-source-agreements --silent || true
}

Write-Host "[✔] Host remediation audit completed for CVE-2024-41071." -ForegroundColor Green

---
# ==============================================================================
# iShareStuff CTI Multi-OS Fleet Remediation Playbook
# Advisory Reference : CVE-2024-41071
# Target Infrastructure : Heterogeneous Fleets
# Timestamp : 2026-09-26 08:10:00 UTC
# ==============================================================================
- name: "CTI Remediation Playbook for CVE-2024-41071"
  hosts: all
  become: true
  gather_facts: true

  tasks:
    - name: "Log remediation initiation for CVE-2024-41071"
      ansible.builtin.debug:
        msg: "Executing automated patch mitigation for advisory CVE-2024-41071 on {{ inventory_hostname }}"

    # Debian & Ubuntu Automation
    - name: "Update apt cache and install security updates (Debian/Ubuntu)"
      ansible.builtin.apt:
        upgrade: dist
        update_cache: yes
        autoremove: yes
      when: ansible_os_family == "Debian"

    # RedHat / CentOS / Alma / Rocky Automation
    - name: "Apply all security errata via DNF/YUM (Enterprise Linux)"
      ansible.builtin.dnf:
        name: "*"
        state: latest
        security: yes
      when: ansible_os_family == "RedHat"

    # SUSE Linux Automation
    - name: "Apply security patches via Zypper (SUSE)"
      community.general.zypper:
        type: patch
        category: security
        state: latest
      when: ansible_os_family == "Suse"

    # Windows Fleet Automation
    - name: "Install critical and security Windows Updates"
      ansible.windows.win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
          - UpdateRollups
        state: installed
      when: ansible_os_family == "Windows"

    - name: "Record audit completion timestamp"
      ansible.builtin.file:
        path: "/var/log/isharestuff_cti_CVE-2024-41071.remediated"
        state: touch
        mode: "0640"
      when: ansible_os_family != "Windows"

#!/usr/sbin/nft -f
# ISS-ZeroTrust Quarantine Policy for CVE-2024-41071
table inet iss_quarantine {
    chain inbound_lockdown {
        type filter hook input priority -10; policy drop;

        # Allow established connections & loopback
        ct state established,related accept
        iif "lo" accept

        # Whitelist SOC / Bastion Management Subnet
        ip saddr 10.0.0.0/8 accept
        ip saddr 192.168.1.0/24 accept

        # Explicitly log & drop vulnerable service traffic
        tcp dport 443 log prefix "[ISS-QUARANTINE-CVE-2024-41071] " drop
    }
}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: quarantine-CVE-2024-41071
  namespace: production
  labels:
    security.isharestuff.com/quarantine: "true"
    cve.mitigation/id: "CVE-2024-41071"
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/vulnerable-cve: "CVE-2024-41071"
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Restrict ingress solely to authorized security scanners & bastion pods
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: soc-monitoring
      ports:
      - port: 443
        protocol: TCP
  egress:
    # Allow DNS only (isolate lateral movement)
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - port: 53
          protocol: UDP

aws ec2 revoke-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0

(http.request.uri.path contains "CVE-2024-41071" or http.request.body.mime contains "exploit" or cf.threat_score gt 20)