USB: core: Fix hang in usb_kill_urb by adding memory barriers
Summary
GSD-2022-1000099: USB: core: Fix hang in usb_kill_urb by adding memory barriers. Affects Kernel versions < 546ba238535d925254e0b3f12012a5c55801e2f3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential services and functions for the system's operation. USB (Universal Serial Bus) is a widely used interface for connecting devices to a computer. The USB core in the Kernel handles the low-level operations and communication with USB devices. However, a vulnerability has been discovered in the USB core that can lead to a hang in the usb_kill_urb function.
Vulnerability Detail
The vulnerability in the USB core arises due to a lack of memory barriers in the usb_kill_urb function. This can result in a hang, causing the system to become unresponsive. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the normal functioning of the system. The vulnerability has been fixed in Linux Kernel version v4.14.265 by commit 546ba238535d925254e0b3f12012a5c55801e2f3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel.
Conclusion
The USB core vulnerability in the Linux Kernel can lead to system hangs and potential denial-of-service conditions. It is crucial to update the Kernel to version v4.14.265 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a hang in the usb_kill_urb function, causing the system to become unresponsive. This can result in a denial-of-service (DoS) condition or disruption of normal system operation.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation. You can also use the Vulert playground (https://vulert.com/scanner) to check the vulnerability status of your application without signing up.
Yes, the vulnerability has been fixed in Linux Kernel version v4.14.265 by commit 546ba238535d925254e0b3f12012a5c55801e2f3. It is recommended to update the Kernel to this version or later.
The vulnerability itself does not involve remote exploitation. However, if an attacker gains access to the system, they could potentially exploit this vulnerability to cause a denial-of-service condition.
If you are unable to update the Kernel immediately, it is recommended to follow general security best practices such as ensuring proper network segmentation, implementing strong access controls, and monitoring for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
