Junglewise Threat Intelligence

CVE-2024-26934: Linux Kernel deadlock in usb_deauthorize_interface

CVE-2024-26934 · Severity: high · CVSS 7.8 · Published 2024-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB subsystem can cause a system deadlock, leading to a complete loss of availability. This occurs when the system attempts to manage USB interface authorizations while a device is being disconnected or reconfigured. An attacker with local access could potentially exploit this to freeze the operating system, disrupting business operations and requiring a hard reboot.

Technical details

A deadlock exists in drivers/usb/core/sysfs.c within the interface_authorized_store() function. This function calls usb_deauthorize_interface(), which attempts to acquire a device lock on an ancestor (parent) USB device. If another process holds that lock while attempting to remove the interface (e.g., during device disconnection), a circular dependency occurs: device_del() waits for sysfs callbacks to finish, while the callback waits for the device lock held by the removal process. The fix involves using sysfs_break_active_protection() to allow the sysfs callback to proceed without blocking the removal procedure. This is a local vulnerability requiring the ability to write to sysfs attributes.

Affected products

  • Linux Linux Kernel 4.4 to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3

Timeline

  • 2024-03-12: other: Vulnerability fix authored
  • 2024-04-03: patched: Fix committed to stable kernel trees
  • 2024-05-01: disclosed: CVE published

References

Related threats