CVE-2024-26715: usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: Fix NULL pointer dereference in dwc3gadgetsuspend
In current scenario if Plug-out and Plug-In performed continuously there could be a chance while checking for dwc->gadgetdriver in dwc3gadgetsuspend, a NULL pointer dereference may occur.
Call Stack:
CPU1: CPU2: gadgetunbinddriver dwc3suspendcommon dwc3gadgetstop dwc3gadgetsuspend dwc3disconnectgadget
CPU1 basically clears the variable and CPU2 checks the variable. Consider CPU1 is running and right before gadgetdriver is cleared and in parallel CPU2 executes dwc3gadgetsuspend where it finds dwc->gadgetdriver which is not NULL and resumes execution and then CPU1 completes execution. CPU2 executes dwc3disconnectgadget where it checks dwc->gadgetdriver is already NULL because of which the NULL pointer deference occur.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26715?
The severity of CVE-2024-26715 is classified as medium due to the possibility of a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2024-26715?
To fix CVE-2024-26715, update to a version of the Linux kernel that is 6.1.123-1, 6.1.119-1, 6.12.10-1, 6.12.11-1 or later if you are using affected versions.
Which Linux kernel versions are vulnerable to CVE-2024-26715?
Linux kernel versions from 3.16.81 to 6.8-rc2 are vulnerable to CVE-2024-26715.
What component of the Linux kernel is affected by CVE-2024-26715?
CVE-2024-26715 affects the USB component of the Linux kernel, specifically the dwc3 gadget driver.
Is CVE-2024-26715 present in all distributions of Linux?
CVE-2024-26715 is primarily associated with the Linux kernel, so it may be present in any distribution that utilizes affected kernel versions.