Circular Locking Dependency in Linux Kernel USB Gadget - CVE-2022-49943
Summary
CVE-2022-49943: In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udc_mutex A recent commit expanding the scope of the udc_lock mutex in the gadget core managed to cause a... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. The USB gadget subsystem allows devices to act as USB peripherals, enabling communication with host systems. This subsystem is critical for devices that require USB connectivity, such as smartphones and embedded systems. The vulnerability CVE-2022-49943 affects the USB gadget functionality, specifically related to mutex locking mechanisms, which can lead to potential deadlocks and system instability.
Vulnerability Detail
CVE-2022-49943 is a vulnerability in the Linux kernel's USB gadget subsystem, where an obscure lockdep violation occurs due to an expanded scope of the udc_lock mutex. This can lead to a circular locking dependency, where a task attempts to acquire a lock that it already holds, resulting in possible deadlocks. The issue arises during the binding and unbinding of gadget drivers, particularly when a disconnect occurs during a critical window. The ramifications include system instability and potential crashes, affecting the reliability of USB devices.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to monitor the system for any unusual behavior related to USB devices and to apply the patch as soon as it is available.
Conclusion
CVE-2022-49943 is a critical vulnerability in the Linux kernel's USB gadget subsystem that can lead to system instability due to circular locking dependencies. It is essential to update to the patched version (6.0.2-1) to mitigate the risks associated with this vulnerability. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49943 is a vulnerability in the Linux kernel's USB gadget subsystem that can lead to circular locking dependencies, potentially causing system instability.
This vulnerability can lead to deadlocks and crashes when USB devices are connected or disconnected, affecting the overall reliability of the system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is recommended to monitor your system for unusual USB behavior and plan to apply the patch as soon as possible.
Detailed information about CVE-2022-49943 can be found in the official Linux kernel documentation and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
