CVE-2024-26749: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fixed memory use after free at cdns3gadgetepdisable()
... cdns3gadgetepfreerequest(&privep->endpoint, &privreq->request); listdelinit(&privreq->list); ...
'privreq' actually free at cdns3gadgetepfreerequest(). But listdelinit() use privreq->list after it.
[ 1542.642868][ T534] BUG: KFENCE: use-after-free read in listdelentryvalid+0x10/0xd4 [ 1542.642868][ T534] [ 1542.653162][ T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3): [ 1542.660311][ T534] listdelentryvalid+0x10/0xd4 [ 1542.665375][ T534] cdns3gadgetepdisable+0x1f8/0x388 [cdns3] [ 1542.671571][ T534] usbepdisable+0x44/0xe4 [ 1542.675948][ T534] ffsfuncepsdisable+0x64/0xc8 [ 1542.680839][ T534] ffsfuncsetalt+0x74/0x368 [ 1542.685478][ T534] ffsfuncdisable+0x18/0x28
Move listdelinit() before cdns3gadgetepfreerequest() to resolve this problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
In cdns3_gadget_ep_disable(), call list_del_init(&priv_req->list) before cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request) to prevent use of priv_req->list after the request is freed.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26749?
CVE-2024-26749 is classified as a high-severity vulnerability that can lead to memory corruption.
Which versions of the Linux kernel are affected by CVE-2024-26749?
CVE-2024-26749 affects Linux kernel versions from 5.4 to 6.8-rc5.
How do I fix CVE-2024-26749?
To mitigate CVE-2024-26749, upgrade to a patched version such as 5.10.223-1 or 6.12.10-1.
What type of vulnerability is CVE-2024-26749?
CVE-2024-26749 is a type of vulnerability related to memory use after free in the Linux kernel.
What impact can CVE-2024-26749 have on systems?
Exploitation of CVE-2024-26749 may allow an attacker to execute arbitrary code or crash the system.