CVE-2024-36977: usb: dwc3: Wait unconditionally after issuing EndXfer command
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: Wait unconditionally after issuing EndXfer command
Currently all controller IP/revisions except DWC3usb3 >= 310a wait 1ms unconditionally for ENDXFER completion when IOC is not set. This is because DWCusb3 controller revisions >= 3.10a supports GUCTL2[14: Rstactbitlater] bit which allows polling CMDACT bit to know whether ENDXFER command is completed.
Consider a case where an IN request was queued, and parallelly softdisconnect was called (due to ffsepfilerelease). This eventually calls stopactivetransfer with IOC cleared, hence sendgadgetepcmd() skips waiting for CMDACT cleared during EndXfer. For DWC3 controllers with revisions >= 310a, we don't forcefully wait for 1ms either, and we proceed by unmapping the requests. If ENDXFER didn't complete by this time, it leads to SMMU faults since the controller would still be accessing those requests.
Fix this by ensuring ENDXFER completion by adding 1ms delay in dwc3stopactivetransfer() unconditionally.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: Wait unconditionally after issuing EndXfer command
The Linux kernel CVE team has assigned CVE-2024-36977 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061804-CVE-2024-36977-e1e8@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.92 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.32 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Configuration
Modify __dwc3_stop_active_transfer() to wait unconditionally 1ms for ENDXFER completion (when IOC is cleared/not set) to prevent SMMU faults from unmapping requests before the controller finishes accessing them. This resolves CVE-2024-36977.
Linux kernel usb: dwc3 __dwc3_stop_active_transfer() EndXfer completion wait = Add unconditionally a 1ms delay after issuing ENDXFER command when IOC is not set
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36977?
CVE-2024-36977 has a moderate severity rating due to its potential impact on USB controller operations.
Which versions of the kernel are affected by CVE-2024-36977?
Affected kernel versions include various releases up to 6.10 for Red Hat and several specific versions for Debian.
How do I fix CVE-2024-36977?
To address CVE-2024-36977, update your kernel to one of the patched versions such as 6.1.92 or 6.6.32.
What systems are vulnerable to CVE-2024-36977?
Systems running the specified vulnerable kernel versions are susceptible to CVE-2024-36977.
Is there a workaround for CVE-2024-36977?
Currently, the recommended mitigation for CVE-2024-36977 is to apply the relevant kernel update as no specific workarounds have been documented.