Command Ring Pointer Corruption in xhci
Summary
GSD-2021-1001952: xhci: Fix command ring pointer corruption while aborting a command. Affects Kernel versions < 22bcb65ea41072ab5d03c0c6290e04e0df6d09a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xhci package is a component of the Linux Kernel that provides support for USB 3.0 and later versions. It handles the communication between USB devices and the host system. The command ring is a data structure used by xhci to manage commands sent to USB devices. It keeps track of the commands and their execution status. However, a vulnerability has been discovered in the xhci package that can lead to command ring pointer corruption while aborting a command.
Vulnerability Detail
The vulnerability in the xhci package allows for command ring pointer corruption when aborting a command. This can result in unexpected behavior and potential security risks. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The issue has been fixed in Linux Kernel version v4.14.252 by commit 22bcb65ea41072ab5d03c0c6290e04e0df6d09a0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The xhci package in the Linux Kernel is vulnerable to command ring pointer corruption while aborting a command. This vulnerability can have serious security implications and should be addressed by updating the Linux Kernel to version v4.14.252 or later. Regularly updating the kernel is important to ensure protection against known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The xhci package is a component of the Linux Kernel that provides support for USB 3.0 and later versions. It handles the communication between USB devices and the host system.
A command ring is a data structure used by xhci to manage commands sent to USB devices. It keeps track of the commands and their execution status.
The command ring pointer corruption vulnerability can lead to unexpected behavior and potential security risks. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
To fix the vulnerability, it is recommended to update the Linux Kernel to version v4.14.252 or later. This can be done by downloading the latest stable version of the Linux Kernel from the official repository and following the installation instructions provided.
There is no specific workaround mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
