Vulnerability in Linux Kernel USB dwc3 Gadget
Summary
GSD-2022-1003288: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback. Affects Kernel versions >= d4f1afe5e896c18ae01099a85dab5e1a198bd2a8, < 1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for hardware interaction, process management, and system resource allocation. The USB dwc3 gadget driver is responsible for handling USB device functionality on systems equipped with DesignWare USB 3.0 controllers. This vulnerability affects the USB dwc3 gadget driver in the Linux Kernel.
Vulnerability Detail
The vulnerability in the USB dwc3 gadget driver arises from the use of the 'list_for_each_entry_safe()' function when using giveback. The specific impact and attack plausibility of this vulnerability have not been proven yet. However, if exploited, it could potentially lead to security breaches, unauthorized access, or system instability. The vulnerability was introduced in Linux Kernel version 5.0 by commit d4f1afe5e896c18ae01099a85dab5e1a198bd2a8 and has been fixed in version 5.15.47 by commit 1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the Linux Kernel USB dwc3 gadget driver can potentially lead to security risks and system instability. It is crucial to update the kernel to the fixed version or apply appropriate security measures to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially lead to security breaches, unauthorized access, or system instability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
No known exploit for this vulnerability has been reported at this time.
The recommended approach is to update the Linux Kernel to the fixed version. However, if updating is not feasible, you can consider implementing additional security measures such as network segmentation, access controls, and intrusion detection systems.
You can find more information about this vulnerability in the GSD-2022-1003288 entry of the GSD Database maintained by the Cloud Security Alliance (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003288.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
