CVE-2024-35822: usb: udc: remove warning when queue disabled ep
First published: Fri May 17 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug().
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <4.19.312 | 4.19.312 |
| redhat/kernel | <5.4.274 | 5.4.274 |
| redhat/kernel | <5.10.215 | 5.10.215 |
| redhat/kernel | <5.15.154 | 5.15.154 |
| redhat/kernel | <6.1.84 | 6.1.84 |
| redhat/kernel | <6.6.24 | 6.6.24 |
| redhat/kernel | <6.7.12 | 6.7.12 |
| redhat/kernel | <6.8.3 | 6.8.3 |
| redhat/kernel | <6.9 | 6.9 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.11-1 6.12.12-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/2a587a035214fa1b5ef598aea0b81848c5b72e5e
- https://git.kernel.org/stable/c/2b002c308e184feeaeb72987bca3f1b11e5f70b8
- https://git.kernel.org/stable/c/30511676eb54d480d014352bf784f02577a10252
- https://git.kernel.org/stable/c/36177c2595df12225b95ce74eb1ac77b43d5a58c
- https://git.kernel.org/stable/c/3e944ddc17c042945d983e006df7860687a8849a
- https://git.kernel.org/stable/c/68d951880d0c52c7f13dcefb5501b69b8605ce8c
- https://git.kernel.org/stable/c/99731076722eb7ed26b0c87c879da7bb71d24290
- https://git.kernel.org/stable/c/df5cbb908f1687e8ab97e222a16b7890d5501acf
- https://git.kernel.org/stable/c/f74c5e0b54b02706d9a862ac6cddade30ac86bcf
- https://launchpad.net/bugs/cve/CVE-2024-35822
- https://access.redhat.com/security/cve/CVE-2024-35822
- https://lore.kernel.org/linux-cve-announce/2024051744-CVE-2024-35822-410b@gregkh/T
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2281193
- https://access.redhat.com/errata/RHSA-2024:9315
- https://bugzilla.redhat.com/show_bug.cgi?id=2281192
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35822
- https://nvd.nist.gov/vuln/detail/CVE-2024-35822
- https://security-tracker.debian.org/tracker/CVE-2024-35822
- https://ubuntu.com/security/CVE-2024-35822
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://git.kernel.org/linus/2a587a035214fa1b5ef598aea0b81848c5b72e5e
Frequently Asked Questions
What is the severity of CVE-2024-35822?
The severity of CVE-2024-35822 is categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35822?
To fix CVE-2024-35822, upgrade to a patched version of the Linux kernel, such as 4.19.312, 5.4.274, 5.10.215, or higher versions specified in the remediation.
Which Linux kernel versions are affected by CVE-2024-35822?
CVE-2024-35822 affects multiple versions of the Linux kernel prior to the specified remedial versions, including versions from Red Hat and Debian distributions.
What does CVE-2024-35822 vulnerability involve?
CVE-2024-35822 involves a warning message that can be triggered from the mass storage function in the Linux kernel's USB device controller.
Is CVE-2024-35822 related to performance issues?
Yes, CVE-2024-35822 can be related to performance issues due to the warning generated when the queue for a disabled endpoint is accessed.
- agent/title
- agent/type
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-api
- source/NVD
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-35822
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/event
- agent/severity
- agent/last-modified-date
- agent/references
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- package-manager/debian