In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix memory double free when handle zero packet
829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832 request); 833 spin_lock(&priv_dev->lock); 834 } 835 836 if (request->buf == priv_dev->zlp_buf) 837 cdns3_gadget_ep_free_request(&priv_ep->endpoint, request);
Driver append an additional zero packet request when queue a packet, which length mod max packet size is 0. When transfer complete, run to line 831, usb_gadget_giveback_request() will free this requestion. 836 condition is true, so cdns3_gadget_ep_free_request() free this request again.
Log:
[ 1920.140696][ T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36): [ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3]
Add check at line 829, skip call usb_gadget_giveback_request() if it is additional zero length packet request. Needn't call usb_gadget_giveback_request() because it is allocated in this driver.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 8, 2024 | Apr 3, 2024 |
| Suse | — | Upgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-buildUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-rt-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-amlogicUpgrade dtb-socionextUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-extraUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-rtUpgrade dtb-amazonUpgrade kernel-source-vanillaUpgrade kernel-syms-rtUpgrade dtb-appleUpgrade kernel-default-base-rebuildUpgrade kernel-docsUpgrade kernel-rt-vdsoUpgrade kernel-azureUpgrade dtb-qcomUpgrade dtb-broadcomUpgrade kernel-obs-qaUpgrade kernel-rt-optionalUpgrade kernel-azure-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade reiserfs-kmp-64kbUpgrade kernel-sourceUpgrade dtb-freescaleUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-mediatekUpgrade dtb-renesasUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade dtb-exynosUpgrade dtb-caviumUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-azureUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade kernel-debug-develUpgrade kernel-64kb-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-develUpgrade dtb-xilinxUpgrade dtb-lgUpgrade ocfs2-kmp-azureUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade dtb-sprdUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-symsUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-defaultUpgrade kernel-64kb | Jun 13, 2024 | Apr 3, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.4.0-1045-xilinx-zynqmpUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-osp1Upgrade linux-image-6.5.0-1027-oemUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-5.4.0-1093-gkeopUpgrade linux-image-5.4.0-1130-gcpUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-5.4.0-1073-ibmUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-5.4.0-1125-oracleUpgrade linux-image-5.4.0-1131-azureUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-20.04Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-starfiveUpgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.4.0-1126-awsUpgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1114-kvmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.4.0-1038-iotUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-22.04dUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-azureUpgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-oemUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-awsUpgrade linux-image-oracle-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-112-genericUpgrade linux-image-gkeop-5.4Upgrade linux-image-virtualUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-genericUpgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-generic-64kUpgrade linux-image-bluefieldUpgrade linux-image-6.5.0-1024-azureUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-5.4.0-1110-raspiUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-186-generic-lpaeUpgrade linux-image-6.5.0-1023-awsUpgrade linux-image-5.4.0-186-genericUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-gke-5.15Upgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-186-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-azure-fdeUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-oracleUpgrade linux-image-azure-lts-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-gkeopUpgrade linux-image-aws-lts-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-gcpUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-5.4.0-1086-bluefieldUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-lpae | Jul 1, 2024 | Apr 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub