cve-2024-56698
Vulnerability from cvelistv5
Published
2024-12-28 09:46
Modified
2025-01-20 06:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0247da93bf62d33304b7bf97850ebf2a86e06d28Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1534f6f69393aac773465d80d31801b554352627Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/70777a23a54e359cfdfafc625a57cd56434f3859Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8ceb21d76426bbe7072cc3e43281e70c0d664cc7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7c3d0b59213ebeedff63d128728ce0b3d7a51ecPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7fc65f5141c24785dc8c19249ca4efcf71b3524Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9e72352a10ae89a430449f7bfeb043e75c255d9Patch
Impacted products
Vendor Product Version
Linux Linux Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
Version: c96e6725db9d6a04ac1bee881e3034b636d9f71c
 Create a notification for this product.
   Linux Linux Version: 4.18
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ceb21d76426bbe7072cc3e43281e70c0d664cc7",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            },
            {
              "lessThan": "0247da93bf62d33304b7bf97850ebf2a86e06d28",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            },
            {
              "lessThan": "c9e72352a10ae89a430449f7bfeb043e75c255d9",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            },
            {
              "lessThan": "1534f6f69393aac773465d80d31801b554352627",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            },
            {
              "lessThan": "b7c3d0b59213ebeedff63d128728ce0b3d7a51ec",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            },
            {
              "lessThan": "70777a23a54e359cfdfafc625a57cd56434f3859",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            },
            {
              "lessThan": "b7fc65f5141c24785dc8c19249ca4efcf71b3524",
              "status": "affected",
              "version": "c96e6725db9d6a04ac1bee881e3034b636d9f71c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix looping of queued SG entries\n\nThe dwc3_request-\u003enum_queued_sgs is decremented on completion. If a\npartially completed request is handled, then the\ndwc3_request-\u003enum_queued_sgs no longer reflects the total number of\nnum_queued_sgs (it would be cleared).\n\nCorrectly check the number of request SG entries remained to be prepare\nand queued. Failure to do this may cause null pointer dereference when\naccessing non-existent SG entry."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:26:25.744Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ceb21d76426bbe7072cc3e43281e70c0d664cc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0247da93bf62d33304b7bf97850ebf2a86e06d28"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9e72352a10ae89a430449f7bfeb043e75c255d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1534f6f69393aac773465d80d31801b554352627"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7c3d0b59213ebeedff63d128728ce0b3d7a51ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/70777a23a54e359cfdfafc625a57cd56434f3859"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7fc65f5141c24785dc8c19249ca4efcf71b3524"
        }
      ],
      "title": "usb: dwc3: gadget: Fix looping of queued SG entries",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56698",
    "datePublished": "2024-12-28T09:46:21.363Z",
    "dateReserved": "2024-12-27T15:00:39.850Z",
    "dateUpdated": "2025-01-20T06:26:25.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56698\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-28T10:15:16.473\",\"lastModified\":\"2025-01-31T15:57:29.440\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: dwc3: gadget: Fix looping of queued SG entries\\n\\nThe dwc3_request-\u003enum_queued_sgs is decremented on completion. If a\\npartially completed request is handled, then the\\ndwc3_request-\u003enum_queued_sgs no longer reflects the total number of\\nnum_queued_sgs (it would be cleared).\\n\\nCorrectly check the number of request SG entries remained to be prepare\\nand queued. Failure to do this may cause null pointer dereference when\\naccessing non-existent SG entry.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: dwc3: gadget: Se corrige el bucle de entradas SG en cola. El dwc3_request-\u0026gt;num_queued_sgs se reduce al completarse. Si se gestiona una solicitud parcialmente completada, entonces el dwc3_request-\u0026gt;num_queued_sgs ya no refleja el n\u00famero total de num_queued_sgs (se borrar\u00eda). Verifique correctamente el n\u00famero de entradas SG de solicitud que quedan por preparar y poner en cola. Si no lo hace, puede causar una desreferencia de puntero nulo al acceder a una entrada SG inexistente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"DA959B78-996E-495B-82A6-CCF300A94875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0247da93bf62d33304b7bf97850ebf2a86e06d28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1534f6f69393aac773465d80d31801b554352627\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70777a23a54e359cfdfafc625a57cd56434f3859\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ceb21d76426bbe7072cc3e43281e70c0d664cc7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7c3d0b59213ebeedff63d128728ce0b3d7a51ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7fc65f5141c24785dc8c19249ca4efcf71b3524\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9e72352a10ae89a430449f7bfeb043e75c255d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.