Описание
In the Linux kernel, the following vulnerability has been resolved:
USB: dwc2: shut down wakeup timer before freeing HCD state
dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
wakeup timer. dwc2_hcd_free() currently deletes the timer only after
freeing host-owned state, and timer_delete() does not synchronize a
callback or prevent it from being queued again.
Stop and shut down the timer in dwc2_hcd_release(), before the HCD
resources are freed. This covers both the HCD initialization error path
and normal HCD removal.
A flaw was found in the Linux kernel's USB DWC2 driver. A race condition during host controller teardown or initialization failure allows the wakeup timer to execute after host resources have been released. A local user could exploit this use-after-free vulnerability to cause a Denial of Service (DoS) by crashing the system.
Отчет
A teardown race exists because dwc2_wakeup_detected can access DWC2 host state and rearm the wakeup timer while dwc2_hcd_free is releasing host owned resources. The previous timer deletion did not synchronize with a running callback and did not prevent that callback from queuing the timer again. This creates a potential use after free that can cause a kernel crash and local denial of service. For the CVSS the PR:L value is used for the paranoid score because reduced capability root, a device management service, or a container with delegated driver control may be able to initiate the relevant HCD teardown without having unrestricted host root privileges. The realistic base case is PR:H because driver unbind, module removal, and normal HCD removal are generally administrator controlled. The issue is not network reachable. A connected USB device may influence wakeup activity, but the available code does not prove that an external device alone can reliably initiate HCD teardown. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to the potential use after free and should be reviewed manually.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
4.7 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
In the Linux kernel, the following vulnerability has been resolved: U ...
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
4.7 Medium
CVSS3