CVE-2024-42244: USB: serial: mos7840: fix crash on resume
First published: Wed Aug 07 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ]
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=3.3<5.10.222 | |
| Linux Kernel | >=5.11<5.15.163 | |
| Linux Kernel | >=5.16<6.1.100 | |
| Linux Kernel | >=6.2<6.6.41 | |
| Linux Kernel | >=6.7<6.9.10 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.128-1 6.12.21-1 | |
| debian/linux-6.1 | 6.1.129-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/1094ed500987e67a9d18b0f95e1812f1cc720856
- https://git.kernel.org/stable/c/553e67dec846323b5575e78a776cf594c13f98c4
- https://git.kernel.org/stable/c/5ae6a64f18211851c8df6b4221381c438b9a7348
- https://git.kernel.org/stable/c/932a86a711c722b45ed47ba2103adca34d225b33
- https://git.kernel.org/stable/c/b14aa5673e0a8077ff4b74f0bb260735e7d5e6a4
- https://git.kernel.org/stable/c/c15a688e49987385baa8804bf65d570e362f8576
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42244
- https://nvd.nist.gov/vuln/detail/CVE-2024-42244
- https://launchpad.net/bugs/cve/CVE-2024-42244
- https://security-tracker.debian.org/tracker/CVE-2024-42244
- https://ubuntu.com/security/CVE-2024-42244
- https://git.kernel.org/linus/c15a688e49987385baa8804bf65d570e362f8576
Frequently Asked Questions
What is the severity of CVE-2024-42244?
CVE-2024-42244 is classified as a moderate severity vulnerability in the Linux kernel related to USB serial devices.
How do I fix CVE-2024-42244?
To resolve CVE-2024-42244, you should update your Linux kernel to the recommended versions, such as 5.10.223-1 or 6.1.123-1.
What versions of the Linux kernel are affected by CVE-2024-42244?
CVE-2024-42244 affects various kernel versions, specifically those between 3.3 and 6.6.41, excluding patched releases.
Is CVE-2024-42244 a local or remote vulnerability?
CVE-2024-42244 is considered a local vulnerability, as it pertains to the handling of USB serial devices when the system resumes.
Who is impacted by CVE-2024-42244?
Users operating affected versions of the Linux kernel, particularly those utilizing USB serial devices, are at risk from CVE-2024-42244.
- agent/type
- agent/remedy
- agent/severity
- agent/title
- agent/first-publish-date
- agent/author
- agent/references
- collector/launchpad-cve
- source/Launchpad
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/3.3
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- package-manager/debian