Vulnerability in Kernel package: usb: dwc2: check return value after calling platform_get_resource()
Summary
GSD-2021-1001633: usb: dwc2: check return value after calling platform_get_resource(). Affects Kernel versions < 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and user applications. The usb: dwc2 module within the Kernel package is responsible for managing USB functionality on devices that use the DesignWare USB Controller IP. This vulnerability specifically relates to the handling of resources obtained through the platform_get_resource() function.
Vulnerability Detail
The vulnerability arises from a failure to check the return value after calling the platform_get_resource() function in the usb: dwc2 module. This oversight could lead to various security issues, such as potential memory corruption or privilege escalation attacks. An attacker could exploit this vulnerability to execute arbitrary code or gain elevated privileges on the affected system. The vulnerability has been addressed in Linux Kernel version v5.10.72 by commit 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider disabling or restricting access to USB functionality on affected devices until the Kernel package is updated. This can be achieved by modifying system configurations or using kernel command-line parameters to disable USB drivers or modules. However, this workaround may impact the functionality of USB devices connected to the system.
Conclusion
In conclusion, the Kernel package's usb: dwc2 module is vulnerable to a security issue that could allow arbitrary code execution or privilege escalation. It is crucial to update the Kernel package to version v5.10.72 or later to mitigate this vulnerability. Users can also consider applying temporary workarounds, such as disabling USB functionality, until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or gain elevated privileges on the affected system, leading to unauthorized access, data breaches, or system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is advisable to apply the recommended fixes as soon as possible to mitigate any potential risks.
As mentioned in the workaround section, you can consider disabling or restricting access to USB functionality on affected devices until the Kernel package is updated. However, this should only be seen as a temporary measure, and it is crucial to apply the official fix as soon as possible.
You can refer to the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) for more details about the fix. The vulnerability details can be found in the GSD-2021-1001633.json file in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001633.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
