Vulnerability in Kernel Package: xhci: Fix command ring abort, write all 64 bits to CRCR register
Summary
GSD-2021-1002451: xhci: Fix commad ring abort, write all 64 bits to CRCR register. Affects Kernel versions >= 01c2dcb67e71c351006dd17cbba86c26b7f61eaf, < 095a39a2cc273d7a7a96a4ead75e3216314060c2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The xhci module within the Kernel package handles USB host controller drivers. It enables communication between USB devices and the operating system. However, a vulnerability has been identified in the xhci module that affects the command ring abort functionality, specifically the writing of all 64 bits to the CRCR (Command Ring Control Register) register.
Vulnerability Detail
The vulnerability in the xhci module's command ring abort functionality arises from an incomplete write operation to the CRCR register. By not writing all 64 bits of data to the register, the command ring abort process may not function as intended. This could potentially lead to command ring corruption or other unexpected behavior. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.4.164 by commit 095a39a2cc273d7a7a96a4ead75e3216314060c2. However, it was introduced in version v5.4.155 by commit 01c2dcb67e71c351006dd17cbba86c26b7f61eaf.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the xhci module in the Kernel package has a vulnerability related to the command ring abort functionality. It is crucial to update the Linux Kernel package to version v5.4.164 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system that manages the system's core functionality.
The xhci module is responsible for handling USB host controller drivers in the Kernel package, facilitating communication between USB devices and the operating system.
The CRCR (Command Ring Control Register) is a register within the xhci module that controls the command ring abort functionality.
The incomplete write operation to the CRCR register may lead to command ring corruption or other unexpected behavior, impacting the functionality of USB devices connected to the system.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.4.164 by commit 095a39a2cc273d7a7a96a4ead75e3216314060c2.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
