CVE-2024-26748: usb: cdns3: fix memory double free when handle zero packet
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix memory double free when handle zero packet
829 if (request->complete) { 830 spinunlock(&privdev->lock); 831 usbgadgetgivebackrequest(&privep->endpoint, 832 request); 833 spinlock(&privdev->lock); 834 } 835 836 if (request->buf == privdev->zlpbuf) 837 cdns3gadgetepfreerequest(&privep->endpoint, request);
Driver append an additional zero packet request when queue a packet, which length mod max packet size is 0. When transfer complete, run to line 831, usbgadgetgivebackrequest() will free this requestion. 836 condition is true, so cdns3gadgetepfreerequest() free this request again.
Log:
[ 1920.140696][ T150] BUG: KFENCE: use-after-free read in cdns3gadgetgiveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36): [ 1920.159082][ T150] cdns3gadgetgiveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3transfercompleted+0x438/0x5f8 [cdns3]
Add check at line 829, skip call usbgadgetgivebackrequest() if it is additional zero length packet request. Needn't call usbgadgetgivebackrequest() because it is allocated in this driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 25 April 2025 - Configuration
In cdns3_gadget_giveback (around line 829), add a condition to skip the call to usb_gadget_giveback_request(&priv_ep->endpoint, request) when the transfer is the additional zero packet request (i.e., when request->buf == priv_dev->zlp_buf), because this request is allocated in this driver and will be freed by cdns3_gadget_ep_free_request().
Linux kernel usb: cdns3 gadget cdns3_gadget_ep_free_request()/usb_gadget_giveback_request() handling for additional zero packet request = Skip usb_gadget_giveback_request() when request->complete for the additional zero length packet request (request->buf == priv_dev->zlp_buf)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26748?
CVE-2024-26748 is classified with a high severity due to its potential to cause memory corruption in the Linux kernel.
How do I fix CVE-2024-26748?
To fix CVE-2024-26748, update the Linux kernel to a version that includes the patch, such as 5.10.223-1 or 6.1.123-1.
Which Linux kernel versions are affected by CVE-2024-26748?
CVE-2024-26748 affects Linux kernel versions from 5.4 up to 6.8-rc5.
What vulnerabilities does CVE-2024-26748 address?
CVE-2024-26748 addresses a memory double free issue when handling zero packets in the Linux kernel's USB subsystem.
Is CVE-2024-26748 a zero-day vulnerability?
No, CVE-2024-26748 has been reported and patched, so it is no longer a zero-day vulnerability.