Vulnerability in Kernel: usb: dwc2: check return value after calling platform_get_resource()
Summary
GSD-2021-1001705: usb: dwc2: check return value after calling platform_get_resource(). Affects Kernel versions < 337f00a0bc62d7cb7d10ec0b872c79009a1641df. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functions and services to enable the proper functioning of the system. The usb-dwc2 driver is responsible for managing USB functionality on devices that utilize the DesignWare USB Controller 2 (DWC2) IP core. This vulnerability specifically affects the handling of resources obtained through the platform_get_resource() function.
Vulnerability Detail
The vulnerability arises from a failure to validate the return value of the platform_get_resource() function in the usb-dwc2 driver. By not checking the return value, the driver may proceed with using a resource that was not successfully obtained, leading to potential issues. Exploiting this vulnerability could result in various consequences, such as system crashes, privilege escalation, or arbitrary code execution. It is important to note that the impact and feasibility of an attack have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually check the return value of the platform_get_resource() function before proceeding with its usage. Here is an example of how this can be done in C code:
struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
// Handle the error or take appropriate action
}
Conclusion
In conclusion, the usb-dwc2 driver in the Linux Kernel is vulnerable to a security issue related to the handling of resources obtained through the platform_get_resource() function. Updating the Kernel to version v5.14.11 or later is the recommended solution. Alternatively, developers can manually check the return value of the function as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary, ranging from system crashes to potential privilege escalation or arbitrary code execution. However, the actual impact and feasibility of an attack have not been proven yet.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.14.11 or later. This update includes the necessary fix for the usb-dwc2 driver.
Yes, a temporary workaround is to manually check the return value of the platform_get_resource() function before using the obtained resource. This can help mitigate the vulnerability until the Kernel is updated.
No, there is no proof of concept or exploit available at the moment. The impact and feasibility of an attack have not been demonstrated.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2021-1001705.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
