Vulnerability in Kernel package: usb: dwc2: check return value after calling platform_get_resource()
Summary
GSD-2021-1001554: usb: dwc2: check return value after calling platform_get_resource(). Affects Kernel versions < a7182993dd8e09f96839ddc3ac54f9b37370d282. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It includes various subsystems and drivers to enable proper communication and control of hardware components. One of these subsystems is the USB (Universal Serial Bus) driver, which allows devices to connect and interact with the system. The dwc2 driver is responsible for managing USB functionality on certain platforms. However, a vulnerability has been identified in the dwc2 driver that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the dwc2 driver arises from a failure to properly check the return value after calling the platform_get_resource() function. This function is used to retrieve platform-specific resources, such as memory regions or I/O ports, required for the driver's operation. By not validating the return value, an attacker could potentially exploit this vulnerability to gain unauthorized access or execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v4.19.210 by commit a7182993dd8e09f96839ddc3ac54f9b37370d282.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Kernel package to version v4.19.210 or later. This can be done by following the official update process provided by the Linux distribution being used. It is crucial to keep the system up to date with the latest security patches to mitigate the risk of potential vulnerabilities.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's dwc2 driver that could potentially allow unauthorized access or arbitrary code execution. It is crucial to update the Kernel package to version v4.19.210 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially allow an attacker to gain unauthorized access or execute arbitrary code on the affected system.
There is no evidence to suggest that this vulnerability has been exploited in the wild at this time.
The vulnerability affects versions of the Kernel package prior to v4.19.210.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update to the fixed version of the Kernel package.
More information about the fix can be found in the commit a7182993dd8e09f96839ddc3ac54f9b37370d282 in the Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.