Fix deadlock in oxu_bus_suspend() in Linux Kernel
Summary
GSD-2022-1003665: drivers: usb: host: Fix deadlock in oxu_bus_suspend(). Affects Kernel versions < 2dcec0bc142be2096af71a5703d63237127db204. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The USB host driver in the Linux Kernel allows communication between the host system and USB devices. The oxu_bus_suspend() function in the USB host driver is responsible for suspending the USB bus. However, a deadlock issue has been identified in this function, which can lead to system instability and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from a deadlock situation in the oxu_bus_suspend() function of the USB host driver. When suspending the USB bus, the function can get stuck in a deadlock, preventing further execution and potentially freezing the system. This vulnerability can be exploited by an attacker to disrupt the normal functioning of the system or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The oxu_bus_suspend() function in the USB host driver of the Linux Kernel is vulnerable to a deadlock issue, which can lead to system instability and potential denial-of-service attacks. The vulnerability has been fixed in the Linux Kernel version v5.4.198 by commit 2dcec0bc142be2096af71a5703d63237127db204. Users are advised to update their Linux Kernel to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to system instability and potential denial-of-service attacks.
An attacker can exploit this vulnerability to disrupt the normal functioning of the system or cause a denial-of-service condition.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix the vulnerability, users should update their Linux Kernel to version v5.4.198 or later.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
