Critical Memory Dereference Vulnerability in Linux Kernel: usb: xhci Driver
Summary
DEBIAN-CVE-2024-45027: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup() If xhci_mem_init() fails, it calls into xhci_mem_cleanup() to mop up the d... Affects linux versions < 6.10.7-1. Fixed in 6.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including device drivers, system calls, and process management. The xHCI (eXtensible Host Controller Interface) driver is responsible for managing USB 3.0 devices. This vulnerability affects the xHCI driver, which is crucial for the proper functioning of USB devices on systems running Debian 13 and 14.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the xHCI driver related to memory management. Specifically, if the function xhci_mem_init() fails before the xhci->interrupters are allocated, but after xhci->max_interrupters has been set, the subsequent call to xhci_mem_cleanup() will attempt to dereference a NULL pointer. This can lead to undefined behavior, crashes, or potential exploitation by an attacker. The vulnerability was discovered during debugging of a DMA allocation issue, highlighting the need for proper checks before dereferencing pointers.
How To Fix
Minimum fixed version
6.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel's xHCI driver poses a significant risk to systems running Debian 13 and 14. It is crucial for users to update their systems to the patched version to mitigate potential threats. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a potential NULL pointer dereference in the xHCI driver, which can lead to system crashes or exploitation.
The vulnerability affects the Linux kernel versions prior to 6.10.7-1 on Debian 13 and 14.
You can check your system's kernel version using the command 'uname -r' in the terminal.
Yes, if left unpatched, this vulnerability could potentially be exploited by attackers to cause system instability or crashes.
Vulert is a tool that can monitor and alert for open-source vulnerabilities in your software. You can use the Vulert playground to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
