Vulnerability in Kernel package: xhci: Fix command ring abort
Summary
GSD-2021-1002400: xhci: Fix commad ring abort, write all 64 bits to CRCR register. Affects Kernel versions >= 22bcb65ea41072ab5d03c0c6290e04e0df6d09a0, < e31a18f3c1f57974b919ae5ed36ed616467f93b3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It includes various subsystems, such as the xHCI (eXtensible Host Controller Interface), which handles USB communication. The xHCI subsystem manages the command ring, which is responsible for issuing commands to USB devices. However, a vulnerability has been identified in the xHCI subsystem that affects the command ring abort functionality.
Vulnerability Detail
The vulnerability in the xHCI subsystem involves an incorrect write operation to the Command Ring Control Register (CRCR). When attempting to abort a command in the command ring, only 32 bits were being written to the CRCR register instead of the required 64 bits. This incomplete write operation could lead to unexpected behavior and potential security risks. Attackers may exploit this vulnerability to manipulate USB commands or cause system instability. The vulnerability was introduced in version v4.14.252 of the Linux Kernel and has been fixed in version v4.14.257.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually modify the code in the xHCI subsystem to ensure that all 64 bits are written to the CRCR register during command ring abort operations. Here is an example of the modified code:
// Original code
write32(&xhci->crcr, lower_32_bits(crcr_val));
// Modified code
write64(&xhci->crcr, crcr_val);
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's xHCI subsystem, specifically related to the command ring abort functionality. This vulnerability can be mitigated by updating the Kernel package to version v4.14.257 or later. A temporary workaround is also available by modifying the code in the xHCI subsystem. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow attackers to manipulate USB commands or cause system instability. It is important to update the Kernel package to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the tool will provide real-time alerts for open-source vulnerabilities.
Yes, a temporary workaround is to manually modify the code in the xHCI subsystem to ensure that all 64 bits are written to the CRCR register during command ring abort operations. Please refer to the provided example code.
To update the Kernel package, you need to download the updated kernel source code from the official Linux Kernel repository and compile it according to the provided instructions. Once the updated kernel is installed, the vulnerability will be mitigated.
You can find more information about this vulnerability in the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the vulnerability database maintained by the Cloud Security Alliance (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
