cve-2024-56670
Vulnerability from cvelistv5
Published
2024-12-27 15:06
Modified
2025-01-20 06:25
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1247e1df086aa6c17ab53cd1bedce70dd7132765Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28b3c03a6790de1f6f2683919ad657840f0f0f58Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4efdfdc32d8d6307f968cd99f1db64468471bab1Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8ca07a3d18f39b1669927ef536e485787e856df6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c83213b6649d22656b3a4e92544ceeea8a2c6c07Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd6b0ca6025f64ccb465a6a3460c5b0307ed9c44Patch
Impacted products
Vendor Product Version
Linux Linux Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
Version: c1dca562be8ada614ef193aa246c6f8705bcd6b9
 Create a notification for this product.
   Linux Linux Version: 2.6.27
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/usb/gadget/function/u_serial.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "4efdfdc32d8d6307f968cd99f1db64468471bab1",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
                  {
                     lessThan: "28b3c03a6790de1f6f2683919ad657840f0f0f58",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
                  {
                     lessThan: "1247e1df086aa6c17ab53cd1bedce70dd7132765",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
                  {
                     lessThan: "c83213b6649d22656b3a4e92544ceeea8a2c6c07",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
                  {
                     lessThan: "8ca07a3d18f39b1669927ef536e485787e856df6",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
                  {
                     lessThan: "dd6b0ca6025f64ccb465a6a3460c5b0307ed9c44",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
                  {
                     lessThan: "4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b",
                     status: "affected",
                     version: "c1dca562be8ada614ef193aa246c6f8705bcd6b9",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/usb/gadget/function/u_serial.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "2.6.27",
                  },
                  {
                     lessThan: "2.6.27",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.4.*",
                     status: "unaffected",
                     version: "5.4.288",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.232",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.175",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.121",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.67",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.12.*",
                     status: "unaffected",
                     version: "6.12.6",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.13",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer\n\nConsidering that in some extreme cases,\nwhen u_serial driver is accessed by multiple threads,\nThread A is executing the open operation and calling the gs_open,\nThread B is executing the disconnect operation and calling the\ngserial_disconnect function,The port->port_usb pointer will be set to NULL.\n\nE.g.\n    Thread A                                 Thread B\n    gs_open()                                gadget_unbind_driver()\n    gs_start_io()                            composite_disconnect()\n    gs_start_rx()                            gserial_disconnect()\n    ...                                      ...\n    spin_unlock(&port->port_lock)\n    status = usb_ep_queue()                  spin_lock(&port->port_lock)\n    spin_lock(&port->port_lock)              port->port_usb = NULL\n    gs_free_requests(port->port_usb->in)     spin_unlock(&port->port_lock)\n    Crash\n\nThis causes thread A to access a null pointer (port->port_usb is null)\nwhen calling the gs_free_requests function, causing a crash.\n\nIf port_usb is NULL, the release request will be skipped as it\nwill be done by gserial_disconnect.\n\nSo add a null pointer check to gs_start_io before attempting\nto access the value of the pointer port->port_usb.\n\nCall trace:\n gs_start_io+0x164/0x25c\n gs_open+0x108/0x13c\n tty_open+0x314/0x638\n chrdev_open+0x1b8/0x258\n do_dentry_open+0x2c4/0x700\n vfs_open+0x2c/0x3c\n path_openat+0xa64/0xc60\n do_filp_open+0xb8/0x164\n do_sys_openat2+0x84/0xf0\n __arm64_sys_openat+0x70/0x9c\n invoke_syscall+0x58/0x114\n el0_svc_common+0x80/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x38/0x68",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-20T06:25:32.004Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/4efdfdc32d8d6307f968cd99f1db64468471bab1",
            },
            {
               url: "https://git.kernel.org/stable/c/28b3c03a6790de1f6f2683919ad657840f0f0f58",
            },
            {
               url: "https://git.kernel.org/stable/c/1247e1df086aa6c17ab53cd1bedce70dd7132765",
            },
            {
               url: "https://git.kernel.org/stable/c/c83213b6649d22656b3a4e92544ceeea8a2c6c07",
            },
            {
               url: "https://git.kernel.org/stable/c/8ca07a3d18f39b1669927ef536e485787e856df6",
            },
            {
               url: "https://git.kernel.org/stable/c/dd6b0ca6025f64ccb465a6a3460c5b0307ed9c44",
            },
            {
               url: "https://git.kernel.org/stable/c/4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b",
            },
         ],
         title: "usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-56670",
      datePublished: "2024-12-27T15:06:31.611Z",
      dateReserved: "2024-12-27T15:00:39.844Z",
      dateUpdated: "2025-01-20T06:25:32.004Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-56670\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:26.890\",\"lastModified\":\"2025-01-06T18:13:02.807\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer\\n\\nConsidering that in some extreme cases,\\nwhen u_serial driver is accessed by multiple threads,\\nThread A is executing the open operation and calling the gs_open,\\nThread B is executing the disconnect operation and calling the\\ngserial_disconnect function,The port->port_usb pointer will be set to NULL.\\n\\nE.g.\\n    Thread A                                 Thread B\\n    gs_open()                                gadget_unbind_driver()\\n    gs_start_io()                            composite_disconnect()\\n    gs_start_rx()                            gserial_disconnect()\\n    ...                                      ...\\n    spin_unlock(&port->port_lock)\\n    status = usb_ep_queue()                  spin_lock(&port->port_lock)\\n    spin_lock(&port->port_lock)              port->port_usb = NULL\\n    gs_free_requests(port->port_usb->in)     spin_unlock(&port->port_lock)\\n    Crash\\n\\nThis causes thread A to access a null pointer (port->port_usb is null)\\nwhen calling the gs_free_requests function, causing a crash.\\n\\nIf port_usb is NULL, the release request will be skipped as it\\nwill be done by gserial_disconnect.\\n\\nSo add a null pointer check to gs_start_io before attempting\\nto access the value of the pointer port->port_usb.\\n\\nCall trace:\\n gs_start_io+0x164/0x25c\\n gs_open+0x108/0x13c\\n tty_open+0x314/0x638\\n chrdev_open+0x1b8/0x258\\n do_dentry_open+0x2c4/0x700\\n vfs_open+0x2c/0x3c\\n path_openat+0xa64/0xc60\\n do_filp_open+0xb8/0x164\\n do_sys_openat2+0x84/0xf0\\n __arm64_sys_openat+0x70/0x9c\\n invoke_syscall+0x58/0x114\\n el0_svc_common+0x80/0xe0\\n do_el0_svc+0x1c/0x28\\n el0_svc+0x38/0x68\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: u_serial: soluciona el problema por el cual gs_start_io se bloqueaba debido al acceso a un puntero nulo. Teniendo en cuenta que en algunos casos extremos, cuando varios subprocesos acceden al controlador u_serial, el subproceso A ejecuta la operación de apertura y llama a gs_open, el subproceso B ejecuta la operación de desconexión y llama a la función gserial_disconnect, el puntero port->port_usb se establecerá en NULL. P. ej. Hilo A Hilo B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Bloqueo Esto hace que el hilo A acceda a un puntero nulo (port->port_usb es nulo) al llamar a la función gs_free_requests, lo que provoca un bloqueo. Si port_usb es NULL, se omitirá la solicitud de liberación, ya que la realizará gserial_disconnect. Por lo tanto, agregue una verificación de puntero nulo a gs_start_io antes de intentar acceder al valor del puntero port->port_usb. Rastreo de llamadas: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invocar_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.27\",\"versionEndExcluding\":\"5.4.288\",\"matchCriteriaId\":\"6E124544-1BF2-4F82-8695-47BCE74E1600\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.232\",\"matchCriteriaId\":\"0B975945-2894-4433-BA59-0988B75B4C12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.175\",\"matchCriteriaId\":\"7A1F3620-6900-4852-9229-C3527377EBDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.121\",\"matchCriteriaId\":\"D8DA16A0-9C6E-493E-90EE-309A34901477\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.67\",\"matchCriteriaId\":\"BF4F2CD1-2CA6-4D6B-9B0C-57C3C4D6544A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1247e1df086aa6c17ab53cd1bedce70dd7132765\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/28b3c03a6790de1f6f2683919ad657840f0f0f58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4efdfdc32d8d6307f968cd99f1db64468471bab1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ca07a3d18f39b1669927ef536e485787e856df6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c83213b6649d22656b3a4e92544ceeea8a2c6c07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd6b0ca6025f64ccb465a6a3460c5b0307ed9c44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.