CVE-2024-42244: USB: serial: mos7840: fix crash on resume
First published: Wed Aug 07 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ]
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | >=3.3<5.10.222 | |
| Linux Linux kernel | >=5.11<5.15.163 | |
| Linux Linux kernel | >=5.16<6.1.100 | |
| Linux Linux kernel | >=6.2<6.6.41 | |
| Linux Linux kernel | >=6.7<6.9.10 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.112-1 6.11.7-1 6.11.9-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/1094ed500987e67a9d18b0f95e1812f1cc720856
- https://git.kernel.org/stable/c/553e67dec846323b5575e78a776cf594c13f98c4
- https://git.kernel.org/stable/c/5ae6a64f18211851c8df6b4221381c438b9a7348
- https://git.kernel.org/stable/c/932a86a711c722b45ed47ba2103adca34d225b33
- https://git.kernel.org/stable/c/b14aa5673e0a8077ff4b74f0bb260735e7d5e6a4
- https://git.kernel.org/stable/c/c15a688e49987385baa8804bf65d570e362f8576
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42244
- https://nvd.nist.gov/vuln/detail/CVE-2024-42244
- https://launchpad.net/bugs/cve/CVE-2024-42244
- https://security-tracker.debian.org/tracker/CVE-2024-42244
- https://ubuntu.com/security/CVE-2024-42244
- https://git.kernel.org/linus/c15a688e49987385baa8804bf65d570e362f8576
- agent/type
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/references
- collector/nvd-cve
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/softwarecombine
- agent/event
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/3.3
- version/linux linux kernel/5.11
- version/linux linux kernel/5.16
- version/linux linux kernel/6.2
- version/linux linux kernel/6.7
- package-manager/debian