Executive brief
A vulnerability in the Linux kernel's USB gadget subsystem could allow a local user to cause a system crash (kernel panic). The issue occurs when the system processes malformed USB descriptors or improperly configured endpoints, leading to a 'null pointer' error. While primarily a risk during the development of new USB gadget drivers, it could be used to disrupt system availability.
Technical details
A NULL pointer dereference exists in the Linux kernel's USB gadget framework within 'drivers/usb/gadget/udc/core.c'. The function 'usb_ep_enable' attempted to access 'ep->desc' to check the 'maxpacket' size without first verifying that the descriptor pointer was non-null. This condition can be triggered by malformed gadget descriptors or endpoints that are not properly configured for the current connection speed. An attacker with local access could potentially trigger this crash to cause a Denial of Service (DoS). The issue has been resolved by adding a check for '!ep->desc' before accessing the descriptor.
Affected products
- Linux Linux Kernel up to 6.10.5
Timeline
- 2024-07-24: disclosed: Patch submitted by developer
- 2024-09-04: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/1a9df57d57452b104c46c918569143cf21d7ebf1
- https://git.kernel.org/stable/c/50c5248b0ea8aae0529fdf28dac42a41312d3b62
- https://git.kernel.org/stable/c/716cba46f73a92645cf13eded8d257ed48afc2a4
- https://git.kernel.org/stable/c/7cc9ebcfe58be22f18056ad8bc6272d120bdcb3e
- https://git.kernel.org/stable/c/973a57891608a98e894db2887f278777f564de18
- https://git.kernel.org/stable/c/a0362cd6e503278add954123957fd47990e8d9bf
- https://git.kernel.org/stable/c/ba15815dd24cc5ec0d23e2170dc58c7db1e03b4a