In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix hang in usb_kill_urb by adding memory barriers
The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It turns out the issue is not unlinking the URB; that works just fine. Rather, the problem arises when the wakeup notification that the URB has completed is not received.
The reason is memory-access ordering on SMP systems. In outline form, usb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on different CPUs perform the following actions:
CPU 0 CPU 1 ---------------------------- --------------------------------- usb_kill_urb(): __usb_hcd_giveback_urb(): ... ... atomic_inc(&urb->reject); atomic_dec(&urb->use_count); ... ... wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0); if (atomic_read(&urb->reject)) wake_up(&usb_kill_urb_queue);
Confining your attention to urb->reject and urb->use_count, you can see that the overall pattern of accesses on CPU 0 is:
write urb->reject, then read urb->use_count;
whereas the overall pattern of accesses on CPU 1 is:
write urb->use_count, then read urb->reject.
This pattern is referred to in memory-model circles as SB (for "Store Buffering"), and it is well known that without suitable enforcement of the desired order of accesses -- in the form of memory barriers -- it is entirely possible for one or both CPUs to execute their reads ahead of their writes. The end result will be that sometimes CPU 0 sees the old un-decremented value of urb->use_count while CPU 1 sees the old un-incremented value of urb->reject. Consequently CPU 0 ends up on the wait queue and never gets woken up, leading to the observed hang in usb_kill_urb().
The same pattern of accesses occurs in usb_poison_urb() and the failure pathway of usb_hcd_submit_urb().
The problem is fixed by adding suitable memory barriers. To provide proper memory-access ordering in the SB pattern, a full barrier is required on both CPUs. The atomic_inc() and atomic_dec() accesses themselves don't provide any memory ordering, but since they are present, we can use the optimized smp_mb__after_atomic() memory barrier in the various routines to obtain the desired effect.
This patch adds the necessary memory barriers.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-abi-stablelistsUpgrade kernel-debugUpgrade perfUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-docUpgrade kernel-rt-coreUpgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-develUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade kernel-tools-libs-devel | Sep 26, 2024 | Jun 20, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perf-debuginfoUpgrade bpftoolUpgrade perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.96-90.460Upgrade kernel-livepatch-4.14.268-205.500Upgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel | Aug 2, 2024 | Jun 20, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 20, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelists | Oct 8, 2024 | Jun 20, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Oct 8, 2024 | Jun 20, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Jun 20, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Sep 25, 2024 | Jun 20, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-debuginfoUpgrade kernel-headersUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-kvmUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade bpftoolUpgrade kernel-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-cross-headersUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel | Oct 2, 2024 | Jun 20, 2024 |
| Suse | — | Upgrade kernel-azure-optionalUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade kernel-preemptUpgrade kernel-symsUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-preempt-develUpgrade kernel-default-baseUpgrade cluster-md-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-rt-livepatchUpgrade kernel-source-azureUpgrade dlm-kmp-rtUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kbUpgrade kernel-sourceUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-default-manUpgrade kernel-docsUpgrade kernel-rtUpgrade kernel-azureUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-default-develUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-azure-baseUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debugUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-devel-azureUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-default-extraUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade kernel-syms-azureUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-vdso | Aug 9, 2024 | Jun 20, 2024 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-ibm-5.4Upgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-bluefieldUpgrade linux-aws-5.4Upgrade linuxUpgrade linux-aws-hweUpgrade linux-gcpUpgrade linux-gcp-4.15Upgrade linux-azure-4.15Upgrade linux-azure-fde-5.15Upgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-aws-fipsUpgrade linux-azure-fipsUpgrade linux-gcp-5.4Upgrade linux-oracleUpgrade linux-gcp-fipsUpgrade linux-azureUpgrade linux-hweUpgrade linux-ibmUpgrade linux-gkeopUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-iot | Nov 19, 2024 | Jun 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub