Junglewise Threat Intelligence

CVE-2024-57913: Linux Kernel race condition in USB FunctionFS

CVE-2024-57913 · Severity: medium · CVSS 4.7 · Published 2025-01-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition in the Linux kernel's USB gadget driver can cause a system crash (kernel panic) under specific configurations. This occurs when the system is configured to treat kernel warnings as fatal errors and a timing conflict happens between the Android Debug Bridge (ADB) daemon and USB controller registration. An attacker with local access could potentially trigger this condition to disrupt system availability.

Technical details

A race condition exists in the Linux kernel USB gadget framework within the f_fs (FunctionFS) driver. The vulnerability is located in the functionfs_bind function, where a WARN_ON macro is triggered if the FunctionFS state is not FFS_ACTIVE during a bind operation. This state mismatch can occur due to a race between the adbd daemon (performing adb_write/adb_open) and UDC (USB Device Controller) write operations via configfs. If the kernel is configured with panic_on_warn=1, this warning results in a kernel panic and denial of service. The fix involves replacing the WARN_ON with a standard error check.

Affected products

  • Linux Linux Kernel 2.6.35 to 5.4.290, 5.5 to 5.10.234, 5.11 to 5.15.177, 5.16 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6

Timeline

  • 2024-12-19: patched: Initial patch submitted by maintainers
  • 2025-01-19: advisory: CVE-2024-57913 published

References

Related threats