Critical Vulnerability in Linux Kernel: USB DWC3 System Suspend Issue
Summary
DEBIAN-CVE-2024-53070: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix fault at system suspend if device was already runtime suspended If the device was already runtime suspended then during system suspend we... Affects linux versions < 6.1.119-1. Fixed in 6.1.119-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The affected package, 'linux', is crucial for system stability and performance. This vulnerability specifically impacts the USB DWC3 driver, which is responsible for managing USB devices connected to the system.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB DWC3 driver related to system suspend operations. If a USB device is already in a runtime suspended state, attempting to access its registers during system suspend can lead to a system crash. This issue arises from improper handling of device states, particularly after the dwc3_core_exit() function is called, which prevents access to device registers on certain platforms.
How To Fix
Minimum fixed version
6.1.119-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid system suspend operations while USB devices are in a runtime suspended state. This may prevent crashes until the kernel is updated with the fix.
Conclusion
The identified vulnerability in the Linux kernel's USB DWC3 driver poses a significant risk during system suspend operations. Users are advised to update their kernel to the latest patched versions to ensure system stability and security. Until the update is applied, avoiding system suspend with connected USB devices is recommended.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes when accessing USB device registers during system suspend, potentially causing data loss or system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, updating the Linux kernel to the specified patched versions will permanently fix the vulnerability.
If an immediate update is not possible, avoid using system suspend while USB devices are connected to mitigate the risk of crashes.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53070.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
