Junglewise Threat Intelligence

CVE-2024-26659: Linux Kernel xHCI out-of-bounds write in USB isochronous transfers

CVE-2024-26659 · Severity: medium · CVSS 5.5 · Published 2024-04-02

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB driver (xHCI) could allow a local user to cause a system crash or instability. The issue occurs when the system incorrectly handles errors from USB devices, leading to memory being freed while it is still in use by the hardware. This could result in a denial-of-service, impacting the availability of the system.

Technical details

A vulnerability exists in the Linux kernel xHCI driver's handling of isochronous (isoc) transfers. When a multi-TRB (Transfer Request Block) Transfer Descriptor (TD) encounters a Babble or Buffer Overrun error on an early TRB, the driver prematurely releases ownership of the TD. However, per the xHCI 4.9 specification, the controller may still own subsequent TRBs in that TD. This leads to a race condition where the remaining TRBs can be freed or overwritten while still in use by the hardware, potentially causing an out-of-bounds write (CWE-787) or kernel panic when the controller later attempts to report completion on the freed memory. The fix ensures the driver maintains TD ownership until the final TRB completion is reported.

Affected products

  • Linux Linux Kernel 5.10.213, 5.11 to 5.15.152, 5.16 to 6.1.82, 6.2 to 6.6.17, 6.7 to 6.7.5, 6.8-rc1, 6.8-rc2

Timeline

  • 2024-01-25: other: Patch submitted by developer
  • 2024-04-02: disclosed: CVE published

References