cve-2024-57913
Vulnerability from cvelistv5
Published
2025-01-19 11:52
Modified
2025-02-02 10:15
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON in functionsfs_bind, which easily leads to the following scenarios. 1.adb_write in adbd 2. UDC write via configfs ================= ===================== ->usb_ffs_open_thread() ->UDC write ->open_functionfs() ->configfs_write_iter() ->adb_open() ->gadget_dev_desc_UDC_store() ->adb_write() ->usb_gadget_register_driver_owner ->driver_register() ->StartMonitor() ->bus_add_driver() ->adb_read() ->gadget_bind_driver() <times-out without BIND event> ->configfs_composite_bind() ->usb_add_function() ->open_functionfs() ->ffs_func_bind() ->adb_open() ->functionfs_bind() <ffs->state !=FFS_ACTIVE> The adb_open, adb_read, and adb_write operations are invoked from the daemon, but trying to bind the function is a process that is invoked by UDC write through configfs, which opens up the possibility of a race condition between the two paths. In this race scenario, the kernel panic occurs due to the WARN_ON from functionfs_bind when panic_on_warn is enabled. This commit fixes the kernel panic by removing the unnecessary WARN_ON. Kernel panic - not syncing: kernel: panic_on_warn set ... [ 14.542395] Call trace: [ 14.542464] ffs_func_bind+0x1c8/0x14a8 [ 14.542468] usb_add_function+0xcc/0x1f0 [ 14.542473] configfs_composite_bind+0x468/0x588 [ 14.542478] gadget_bind_driver+0x108/0x27c [ 14.542483] really_probe+0x190/0x374 [ 14.542488] __driver_probe_device+0xa0/0x12c [ 14.542492] driver_probe_device+0x3c/0x220 [ 14.542498] __driver_attach+0x11c/0x1fc [ 14.542502] bus_for_each_dev+0x104/0x160 [ 14.542506] driver_attach+0x24/0x34 [ 14.542510] bus_add_driver+0x154/0x270 [ 14.542514] driver_register+0x68/0x104 [ 14.542518] usb_gadget_register_driver_owner+0x48/0xf4 [ 14.542523] gadget_dev_desc_UDC_store+0xf8/0x144 [ 14.542526] configfs_write_iter+0xf0/0x138
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/19fc1c83454ca9d5699e39633ec79ce26355251c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3e4d32cc145955d5c56c5498a3ff057e4aafa9d1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/82f60f3600aecd9ffcd0fbc4e193694511c85b47
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bfe60030fcd976e3546e1f73d6d0eb3fea26442e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dfc51e48bca475bbee984e90f33fdc537ce09699
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ea6a1498742430eb2effce0d1439ff29ef37dd7d
Impacted products
Vendor Product Version
Linux Linux Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
Version: ddf8abd2599491cbad959c700b90ba72a5dce8d0
 Create a notification for this product.
   Linux Linux Version: 2.6.35
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bfe60030fcd976e3546e1f73d6d0eb3fea26442e",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            },
            {
              "lessThan": "3e4d32cc145955d5c56c5498a3ff057e4aafa9d1",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            },
            {
              "lessThan": "19fc1c83454ca9d5699e39633ec79ce26355251c",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            },
            {
              "lessThan": "82f60f3600aecd9ffcd0fbc4e193694511c85b47",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            },
            {
              "lessThan": "ea6a1498742430eb2effce0d1439ff29ef37dd7d",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            },
            {
              "lessThan": "a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            },
            {
              "lessThan": "dfc51e48bca475bbee984e90f33fdc537ce09699",
              "status": "affected",
              "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Remove WARN_ON in functionfs_bind\n\nThis commit addresses an issue related to below kernel panic where\npanic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON\nin functionsfs_bind, which easily leads to the following scenarios.\n\n1.adb_write in adbd               2. UDC write via configfs\n  =================\t             =====================\n\n-\u003eusb_ffs_open_thread()           -\u003eUDC write\n -\u003eopen_functionfs()               -\u003econfigfs_write_iter()\n  -\u003eadb_open()                      -\u003egadget_dev_desc_UDC_store()\n   -\u003eadb_write()                     -\u003eusb_gadget_register_driver_owner\n                                      -\u003edriver_register()\n-\u003eStartMonitor()                       -\u003ebus_add_driver()\n -\u003eadb_read()                           -\u003egadget_bind_driver()\n\u003ctimes-out without BIND event\u003e           -\u003econfigfs_composite_bind()\n                                          -\u003eusb_add_function()\n-\u003eopen_functionfs()                        -\u003effs_func_bind()\n -\u003eadb_open()                               -\u003efunctionfs_bind()\n                                       \u003cffs-\u003estate !=FFS_ACTIVE\u003e\n\nThe adb_open, adb_read, and adb_write operations are invoked from the\ndaemon, but trying to bind the function is a process that is invoked by\nUDC write through configfs, which opens up the possibility of a race\ncondition between the two paths. In this race scenario, the kernel panic\noccurs due to the WARN_ON from functionfs_bind when panic_on_warn is\nenabled. This commit fixes the kernel panic by removing the unnecessary\nWARN_ON.\n\nKernel panic - not syncing: kernel: panic_on_warn set ...\n[   14.542395] Call trace:\n[   14.542464]  ffs_func_bind+0x1c8/0x14a8\n[   14.542468]  usb_add_function+0xcc/0x1f0\n[   14.542473]  configfs_composite_bind+0x468/0x588\n[   14.542478]  gadget_bind_driver+0x108/0x27c\n[   14.542483]  really_probe+0x190/0x374\n[   14.542488]  __driver_probe_device+0xa0/0x12c\n[   14.542492]  driver_probe_device+0x3c/0x220\n[   14.542498]  __driver_attach+0x11c/0x1fc\n[   14.542502]  bus_for_each_dev+0x104/0x160\n[   14.542506]  driver_attach+0x24/0x34\n[   14.542510]  bus_add_driver+0x154/0x270\n[   14.542514]  driver_register+0x68/0x104\n[   14.542518]  usb_gadget_register_driver_owner+0x48/0xf4\n[   14.542523]  gadget_dev_desc_UDC_store+0xf8/0x144\n[   14.542526]  configfs_write_iter+0xf0/0x138"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-02T10:15:41.117Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bfe60030fcd976e3546e1f73d6d0eb3fea26442e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e4d32cc145955d5c56c5498a3ff057e4aafa9d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/19fc1c83454ca9d5699e39633ec79ce26355251c"
        },
        {
          "url": "https://git.kernel.org/stable/c/82f60f3600aecd9ffcd0fbc4e193694511c85b47"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea6a1498742430eb2effce0d1439ff29ef37dd7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfc51e48bca475bbee984e90f33fdc537ce09699"
        }
      ],
      "title": "usb: gadget: f_fs: Remove WARN_ON in functionfs_bind",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57913",
    "datePublished": "2025-01-19T11:52:35.149Z",
    "dateReserved": "2025-01-19T11:50:08.374Z",
    "dateUpdated": "2025-02-02T10:15:41.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57913\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T12:15:25.477\",\"lastModified\":\"2025-02-02T11:15:13.780\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: f_fs: Remove WARN_ON in functionfs_bind\\n\\nThis commit addresses an issue related to below kernel panic where\\npanic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON\\nin functionsfs_bind, which easily leads to the following scenarios.\\n\\n1.adb_write in adbd               2. UDC write via configfs\\n  =================\\t             =====================\\n\\n-\u003eusb_ffs_open_thread()           -\u003eUDC write\\n -\u003eopen_functionfs()               -\u003econfigfs_write_iter()\\n  -\u003eadb_open()                      -\u003egadget_dev_desc_UDC_store()\\n   -\u003eadb_write()                     -\u003eusb_gadget_register_driver_owner\\n                                      -\u003edriver_register()\\n-\u003eStartMonitor()                       -\u003ebus_add_driver()\\n -\u003eadb_read()                           -\u003egadget_bind_driver()\\n\u003ctimes-out without BIND event\u003e           -\u003econfigfs_composite_bind()\\n                                          -\u003eusb_add_function()\\n-\u003eopen_functionfs()                        -\u003effs_func_bind()\\n -\u003eadb_open()                               -\u003efunctionfs_bind()\\n                                       \u003cffs-\u003estate !=FFS_ACTIVE\u003e\\n\\nThe adb_open, adb_read, and adb_write operations are invoked from the\\ndaemon, but trying to bind the function is a process that is invoked by\\nUDC write through configfs, which opens up the possibility of a race\\ncondition between the two paths. In this race scenario, the kernel panic\\noccurs due to the WARN_ON from functionfs_bind when panic_on_warn is\\nenabled. This commit fixes the kernel panic by removing the unnecessary\\nWARN_ON.\\n\\nKernel panic - not syncing: kernel: panic_on_warn set ...\\n[   14.542395] Call trace:\\n[   14.542464]  ffs_func_bind+0x1c8/0x14a8\\n[   14.542468]  usb_add_function+0xcc/0x1f0\\n[   14.542473]  configfs_composite_bind+0x468/0x588\\n[   14.542478]  gadget_bind_driver+0x108/0x27c\\n[   14.542483]  really_probe+0x190/0x374\\n[   14.542488]  __driver_probe_device+0xa0/0x12c\\n[   14.542492]  driver_probe_device+0x3c/0x220\\n[   14.542498]  __driver_attach+0x11c/0x1fc\\n[   14.542502]  bus_for_each_dev+0x104/0x160\\n[   14.542506]  driver_attach+0x24/0x34\\n[   14.542510]  bus_add_driver+0x154/0x270\\n[   14.542514]  driver_register+0x68/0x104\\n[   14.542518]  usb_gadget_register_driver_owner+0x48/0xf4\\n[   14.542523]  gadget_dev_desc_UDC_store+0xf8/0x144\\n[   14.542526]  configfs_write_iter+0xf0/0x138\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: f_fs: eliminar WARN_ON en functionfs_bind Esta confirmaci\u00f3n soluciona un problema relacionado con el p\u00e1nico del kernel que se muestra a continuaci\u00f3n, donde panic_on_warn est\u00e1 habilitado. Es causado por el uso innecesario de WARN_ON en functionsfs_bind, lo que f\u00e1cilmente conduce a los siguientes escenarios. 1.adb_write en adbd 2. Escritura de UDC a trav\u00e9s de configfs ================= ====================== -\u0026gt;usb_ffs_open_thread() -\u0026gt;Escritura de UDC -\u0026gt;open_functionfs() -\u0026gt;configfs_write_iter() -\u0026gt;adb_open() -\u0026gt;gadget_dev_desc_UDC_store() -\u0026gt;adb_write() -\u0026gt;usb_gadget_register_driver_owner -\u0026gt;driver_register() -\u0026gt;StartMonitor() -\u0026gt;bus_add_driver() -\u0026gt;adb_read() -\u0026gt;gadget_bind_driver()  -\u0026gt;configfs_composite_bind() -\u0026gt;usb_add_function() -\u0026gt;open_functionfs() -\u0026gt;ffs_func_bind() -\u0026gt;adb_open() -\u0026gt;functionfs_bind() state !=FFS_ACTIVE\u0026gt; Las operaciones adb_open, adb_read y adb_write se invocan desde el daemon, pero intentar vincular la funci\u00f3n es un proceso que se invoca mediante escritura UDC a trav\u00e9s de configfs, lo que abre la posibilidad de una condici\u00f3n de ejecuci\u00f3n entre las dos rutas. En este escenario de ejecuci\u00f3n, el p\u00e1nico del kernel se produce debido al WARN_ON de functionfs_bind cuando panic_on_warn est\u00e1 habilitado. Esta confirmaci\u00f3n corrige el p\u00e1nico del kernel eliminando el WARN_ON innecesario. P\u00e1nico del n\u00facleo: no se sincroniza: n\u00facleo: panic_on_warn establecido ... [ 14.542395] Seguimiento de llamadas: [ 14.542464] ffs_func_bind+0x1c8/0x14a8 [ 14.542468] usb_add_function+0xcc/0x1f0 [ 14.542473] configfs_composite_bind+0x468/0x588 [ 14.542478] gadget_bind_driver+0x108/0x27c [ 14.542483] really_probe+0x190/0x374 [ 14.542488] __driver_probe_device+0xa0/0x12c [ 14.542492] controlador_probe_device+0x3c/0x220 [ 14.542498] __driver_attach+0x11c/0x1fc [ 14.542502] bus_for_each_dev+0x104/0x160 [ 14.542506] controlador_attach+0x24/0x34 [ 14.542510] bus_add_driver+0x154/0x270 [ 14.542514] controlador_register+0x68/0x104 [ 14.542518] usb_gadget_register_driver_owner+0x48/0xf4 [ 14.542523] gadget_dev_desc_UDC_store+0xf8/0x144 [ 14.542526] configfs_write_iter+0xf0/0x138\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19fc1c83454ca9d5699e39633ec79ce26355251c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3e4d32cc145955d5c56c5498a3ff057e4aafa9d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/82f60f3600aecd9ffcd0fbc4e193694511c85b47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bfe60030fcd976e3546e1f73d6d0eb3fea26442e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dfc51e48bca475bbee984e90f33fdc537ce09699\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea6a1498742430eb2effce0d1439ff29ef37dd7d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.