USB: core: Fix hang in usb_kill_urb by adding memory barriers
Summary
GSD-2022-1000081: USB: core: Fix hang in usb_kill_urb by adding memory barriers. Affects Kernel versions < b50f5ca60475710bbc9a3af32fbfc17b1e69c2f0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USB core is a fundamental component of the Linux Kernel that handles USB device communication. It provides the necessary infrastructure for USB drivers to interact with USB devices. USB devices are widely used for various purposes, including data transfer and peripheral connectivity. However, the USB core is susceptible to a vulnerability that can lead to a hang in the usb_kill_urb function. This vulnerability can potentially disrupt USB device communication and cause system instability.
Vulnerability Detail
The vulnerability in the USB core arises from a lack of memory barriers in the usb_kill_urb function. Memory barriers are synchronization primitives used to enforce ordering and visibility of memory operations. Without proper memory barriers, concurrent access to shared data structures can result in inconsistent states and race conditions. In the case of usb_kill_urb, this can lead to a hang where the function fails to terminate, potentially causing USB devices to become unresponsive and impacting system performance. The vulnerability has been addressed in Linux Kernel version v4.9.300 by adding the necessary memory barriers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The USB core vulnerability in the Linux Kernel, which could lead to a hang in the usb_kill_urb function, has been addressed in Linux Kernel version v4.9.300. Users are advised to update their Linux Kernel to the fixed version to mitigate any potential risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a hang in the usb_kill_urb function, causing USB devices to become unresponsive and potentially impacting system stability and performance.
At the time of this report, there is no known exploit for this vulnerability. However, it is advisable to apply the recommended fix to mitigate any potential risks.
No, this vulnerability requires local access to the affected system. It cannot be exploited remotely over a network.
No, the vulnerability is present in Linux Kernel versions prior to v4.9.300. The fix has been implemented in Linux Kernel version v4.9.300 and later.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
