Fix deadlock in oxu_bus_suspend() in Linux Kernel
Summary
GSD-2022-1003824: drivers: usb: host: Fix deadlock in oxu_bus_suspend(). Affects Kernel versions < f8242044c91cafbba9e320b0fb31abf2429a3221. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for the system, including device drivers, memory management, and process scheduling. The USB host driver in the Linux Kernel allows the system to interact with USB devices connected to the host. However, a vulnerability has been identified in the oxu_bus_suspend() function of the USB host driver, which can lead to a deadlock situation.
Vulnerability Detail
The oxu_bus_suspend() function in the USB host driver of the Linux Kernel is susceptible to a deadlock. When the function is called to suspend the USB bus, it may acquire a spinlock while holding another spinlock, leading to a deadlock scenario. This can result in a system freeze or unresponsiveness, impacting the availability and reliability of the system. The vulnerability has been addressed in Linux Kernel version v4.19.247 by commit f8242044c91cafbba9e320b0fb31abf2429a3221.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the fix mentioned in the 'how_to_fix' section to ensure the system is protected against the deadlock issue.
Conclusion
The oxu_bus_suspend() function in the USB host driver of the Linux Kernel is vulnerable to a deadlock issue. This can lead to system freeze or unresponsiveness. It is crucial to update the Linux Kernel to version v4.19.247 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a deadlock situation in the Linux Kernel's USB host driver, resulting in system freeze or unresponsiveness.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities.
No, there is no temporary fix available for this vulnerability. It is recommended to update the Linux Kernel to the patched version.
The vulnerability is present in Linux Kernel versions prior to v4.19.247. The fix has been implemented in this version and later releases.
The specific details regarding remote exploitation have not been provided. However, it is important to apply the fix to ensure the system is protected against potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
