Critical USB Driver Task Hang Vulnerability in Linux Package
Summary
DEBIAN-CVE-2024-50100: In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix "task hung" problem The syzbot fuzzer has been encountering "task hung" problems ever since the dummy-hcd driver was changed... Affects linux versions < 6.11.5-1. Fixed in 6.11.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and managing system processes. The package is known for its stability and performance, but it is also susceptible to vulnerabilities that can impact system reliability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB gadget dummy-hcd driver, which has been causing 'task hung' problems. This issue originated from a change that replaced regular timers with high-resolution timers (hrtimers) without adequately addressing the differences in their APIs. The incorrect implementation led to situations where the driver could mistakenly believe that a callback routine had not started, resulting in the hrtimer not being restarted. Consequently, this caused usb_kill_urb() to hang, leading to broader system instability and potential denial of service.
How To Fix
Minimum fixed version
6.11.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to prevent any potential issues.
Conclusion
The identified vulnerability in the Linux package's USB gadget dummy-hcd driver poses significant risks to system stability. Users are strongly advised to update to the latest patched version to ensure their systems remain secure and functional. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to the USB gadget dummy-hcd driver in the Linux kernel, causing task hang issues due to improper timer management.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to system hangs, affecting the stability and performance of applications relying on USB functionalities.
Yes, a patch has been released in version 6.11.5-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and apply the update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
