Vulnerability in Kernel package: usb: dwc2: check return value after calling platform_get_resource()
Summary
GSD-2021-1001527: usb: dwc2: check return value after calling platform_get_resource(). Affects Kernel versions < 4b7f4a0eb92bf37bea4cd838c7f83ea42823ca8b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an integral part of the Linux operating system, responsible for managing the core functionalities and communication between hardware and software components. It provides essential services and drivers for various devices, including USB controllers. The dwc2 driver within the Kernel package handles the functionality of DesignWare USB 2.0 Controller. This vulnerability specifically affects the dwc2 driver's handling of platform resources.
Vulnerability Detail
The vulnerability arises from a lack of proper error handling in the dwc2 driver's code when calling the platform_get_resource() function. By not checking the return value of this function, potential errors or resource allocation failures are not appropriately handled. This oversight could lead to various security issues, such as resource conflicts, memory corruption, or denial-of-service attacks. Exploiting this vulnerability could allow an attacker to gain unauthorized access, manipulate data, or disrupt the normal operation of the USB controller.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually check the return value of platform_get_resource() and handle any potential errors or failures. Here is an example of how this can be done in C code:
struct resource *res;
res = platform_get_resource(dev, IORESOURCE_MEM, 0);
if (!res) {
// Handle error or failure
}
By explicitly checking the return value, developers can implement their own error handling logic to mitigate the vulnerability.
Conclusion
In conclusion, the Kernel package's dwc2 driver is vulnerable to a security issue arising from the lack of proper error handling when calling platform_get_resource(). This vulnerability can have severe consequences, including unauthorized access, data manipulation, and system disruptions. It is crucial to update the Kernel package to version v4.14.250 or later to mitigate this vulnerability. Additionally, developers can implement the provided workaround to add an extra layer of protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to exploit the USB controller, gaining unauthorized access, manipulating data, or causing disruptions in the system's operation.
Yes, systems using versions of the Linux Kernel prior to v4.14.250 are affected by this vulnerability. It is recommended to update to the latest version to mitigate the risk.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the necessary updates and fixes to ensure the security of your system.
This vulnerability can potentially be exploited remotely if the attacker has network access to the affected system. It is important to update the Kernel package to the latest version to prevent any remote exploitation attempts.
Besides updating the Kernel package, developers can implement the provided workaround by manually checking the return value of platform_get_resource() and handling any potential errors or failures.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
