cve-2024-50100
Vulnerability from cvelistv5
Published
2024-11-05 17:07
Modified
2024-12-19 09:33
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix "task hung" problem The syzbot fuzzer has been encountering "task hung" problems ever since the dummy-hcd driver was changed to use hrtimers instead of regular timers. It turns out that the problems are caused by a subtle difference between the timer_pending() and hrtimer_active() APIs. The changeover blindly replaced the first by the second. However, timer_pending() returns True when the timer is queued but not when its callback is running, whereas hrtimer_active() returns True when the hrtimer is queued _or_ its callback is running. This difference occasionally caused dummy_urb_enqueue() to think that the callback routine had not yet started when in fact it was almost finished. As a result the hrtimer was not restarted, which made it impossible for the driver to dequeue later the URB that was just enqueued. This caused usb_kill_urb() to hang, and things got worse from there. Since hrtimers have no API for telling when they are queued and the callback isn't running, the driver must keep track of this for itself. That's what this patch does, adding a new "timer_pending" flag and setting or clearing it at the appropriate times.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5189df7b8088268012882c220d6aca4e64981348Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7d85884576a3be3616c260fc1fa862a59579d1abPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cf7ee2291da551fc4b109fda1f6a332cb8212065Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f828205ee3e4ddc712a13fba6c9902d51e91ddafPatch
Impacted products
Vendor Product Version
Linux Linux Version: 8ffba8d917f44a8acbfccbdec331204353ac8ac8
Version: 4a4cb56556124027f4846ff30849c0ede981aa92
Version: a7f3813e589fd8e2834720829a47b5eb914a9afe
Version: a7f3813e589fd8e2834720829a47b5eb914a9afe
 Create a notification for this product.
   Linux Linux Version: 6.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/dummy_hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf7ee2291da551fc4b109fda1f6a332cb8212065",
              "status": "affected",
              "version": "8ffba8d917f44a8acbfccbdec331204353ac8ac8",
              "versionType": "git"
            },
            {
              "lessThan": "7d85884576a3be3616c260fc1fa862a59579d1ab",
              "status": "affected",
              "version": "4a4cb56556124027f4846ff30849c0ede981aa92",
              "versionType": "git"
            },
            {
              "lessThan": "f828205ee3e4ddc712a13fba6c9902d51e91ddaf",
              "status": "affected",
              "version": "a7f3813e589fd8e2834720829a47b5eb914a9afe",
              "versionType": "git"
            },
            {
              "lessThan": "5189df7b8088268012882c220d6aca4e64981348",
              "status": "affected",
              "version": "a7f3813e589fd8e2834720829a47b5eb914a9afe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/dummy_hcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: dummy-hcd: Fix \"task hung\" problem\n\nThe syzbot fuzzer has been encountering \"task hung\" problems ever\nsince the dummy-hcd driver was changed to use hrtimers instead of\nregular timers.  It turns out that the problems are caused by a subtle\ndifference between the timer_pending() and hrtimer_active() APIs.\n\nThe changeover blindly replaced the first by the second.  However,\ntimer_pending() returns True when the timer is queued but not when its\ncallback is running, whereas hrtimer_active() returns True when the\nhrtimer is queued _or_ its callback is running.  This difference\noccasionally caused dummy_urb_enqueue() to think that the callback\nroutine had not yet started when in fact it was almost finished.  As a\nresult the hrtimer was not restarted, which made it impossible for the\ndriver to dequeue later the URB that was just enqueued.  This caused\nusb_kill_urb() to hang, and things got worse from there.\n\nSince hrtimers have no API for telling when they are queued and the\ncallback isn\u0027t running, the driver must keep track of this for itself.\nThat\u0027s what this patch does, adding a new \"timer_pending\" flag and\nsetting or clearing it at the appropriate times."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:33:05.745Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf7ee2291da551fc4b109fda1f6a332cb8212065"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d85884576a3be3616c260fc1fa862a59579d1ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/f828205ee3e4ddc712a13fba6c9902d51e91ddaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5189df7b8088268012882c220d6aca4e64981348"
        }
      ],
      "title": "USB: gadget: dummy-hcd: Fix \"task hung\" problem",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50100",
    "datePublished": "2024-11-05T17:07:37.997Z",
    "dateReserved": "2024-10-21T19:36:19.945Z",
    "dateUpdated": "2024-12-19T09:33:05.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50100\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-05T18:15:13.757\",\"lastModified\":\"2024-11-12T14:57:44.877\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nUSB: gadget: dummy-hcd: Fix \\\"task hung\\\" problem\\n\\nThe syzbot fuzzer has been encountering \\\"task hung\\\" problems ever\\nsince the dummy-hcd driver was changed to use hrtimers instead of\\nregular timers.  It turns out that the problems are caused by a subtle\\ndifference between the timer_pending() and hrtimer_active() APIs.\\n\\nThe changeover blindly replaced the first by the second.  However,\\ntimer_pending() returns True when the timer is queued but not when its\\ncallback is running, whereas hrtimer_active() returns True when the\\nhrtimer is queued _or_ its callback is running.  This difference\\noccasionally caused dummy_urb_enqueue() to think that the callback\\nroutine had not yet started when in fact it was almost finished.  As a\\nresult the hrtimer was not restarted, which made it impossible for the\\ndriver to dequeue later the URB that was just enqueued.  This caused\\nusb_kill_urb() to hang, and things got worse from there.\\n\\nSince hrtimers have no API for telling when they are queued and the\\ncallback isn\u0027t running, the driver must keep track of this for itself.\\nThat\u0027s what this patch does, adding a new \\\"timer_pending\\\" flag and\\nsetting or clearing it at the appropriate times.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: USB: gadget: dummy-hcd: soluciona el problema de \\\"tarea colgada\\\" El fuzzer syzbot ha estado encontrando problemas de \\\"tarea colgada\\\" desde que se cambi\u00f3 el controlador dummy-hcd para usar temporizadores hrtimer en lugar de temporizadores normales. Resulta que los problemas son causados por una diferencia sutil entre las API timer_pending() y hrtimer_active(). El cambio reemplaz\u00f3 ciegamente la primera por la segunda. Sin embargo, timer_pending() devuelve True cuando el temporizador est\u00e1 en cola pero no cuando su devoluci\u00f3n de llamada se est\u00e1 ejecutando, mientras que hrtimer_active() devuelve True cuando el hrtimer est\u00e1 en cola _o_ su devoluci\u00f3n de llamada se est\u00e1 ejecutando. Esta diferencia ocasionalmente hizo que dummy_urb_enqueue() pensara que la rutina de devoluci\u00f3n de llamada a\u00fan no hab\u00eda comenzado cuando, de hecho, estaba casi terminada. Como resultado, el hrtimer no se reinici\u00f3, lo que hizo imposible que el controlador quitara de la cola m\u00e1s tarde el URB que acababa de ponerse en cola. Esto provoc\u00f3 que usb_kill_urb() se bloqueara y las cosas empeoraron a partir de ah\u00ed. Dado que los temporizadores hr no tienen una API para saber cu\u00e1ndo est\u00e1n en cola y la devoluci\u00f3n de llamada no se est\u00e1 ejecutando, el controlador debe realizar un seguimiento de esto por s\u00ed mismo. Eso es lo que hace este parche, agregando un nuevo indicador \\\"timer_pending\\\" y configur\u00e1ndolo o borr\u00e1ndolo en los momentos apropiados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.11.5\",\"matchCriteriaId\":\"E1D573E2-61FD-4C3B-B3BD-5FBEFD6391F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5189df7b8088268012882c220d6aca4e64981348\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d85884576a3be3616c260fc1fa862a59579d1ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf7ee2291da551fc4b109fda1f6a332cb8212065\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f828205ee3e4ddc712a13fba6c9902d51e91ddaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.