vulnerability
Ubuntu: (Multiple Advisories) (CVE-2024-42085): Linux kernel vulnerabilities
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | Jul 29, 2024 | Sep 16, 2024 | Jan 30, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system
to enter suspend status with below command:
echo mem > /sys/power/state
There will be a deadlock issue occurring. Detailed invoking path as
below:
dwc3_suspend_common()
spin_lock_irqsave(&dwc->lock, flags); dwc3_gadget_suspend(dwc);
dwc3_gadget_soft_disconnect(dwc);
spin_lock_irqsave(&dwc->lock, flags); This issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix
NULL pointer dereference in dwc3_gadget_suspend") that removes the code
of checking whether dwc->gadget_driver is NULL or not. It causes the
following code is executed and deadlock occurs when trying to get the
spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3:
Remove DWC3 locking during gadget suspend/resume") that forgot to remove
the lock of otg mode. So, remove the redundant lock of otg mode during
gadget suspend/resume.
Solution(s)
References
- CVE-2024-42085
- https://attackerkb.com/topics/CVE-2024-42085
- UBUNTU-USN-7007-1
- UBUNTU-USN-7007-2
- UBUNTU-USN-7007-3
- UBUNTU-USN-7009-1
- UBUNTU-USN-7009-2
- UBUNTU-USN-7019-1
- UBUNTU-USN-7089-1
- UBUNTU-USN-7089-2
- UBUNTU-USN-7089-3
- UBUNTU-USN-7089-4
- UBUNTU-USN-7089-5
- UBUNTU-USN-7089-6
- UBUNTU-USN-7089-7
- UBUNTU-USN-7090-1
- UBUNTU-USN-7095-1
- UBUNTU-USN-7156-1

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.