USB: core: Fix hang in usb_kill_urb by adding memory barriers
Summary
GSD-2022-1000152: USB: core: Fix hang in usb_kill_urb by adding memory barriers. Affects Kernel versions < 9c61fce322ac2ef7fecf025285353570d60e41d6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USB core is a fundamental component of the Linux Kernel that provides support for USB devices. It handles various USB operations, including device enumeration, data transfer, and power management. USB devices are widely used in computer systems for connecting peripherals such as keyboards, mice, printers, and storage devices. However, the USB core is susceptible to vulnerabilities that can be exploited by attackers to compromise the system's security and stability.
Vulnerability Detail
The vulnerability identified as GSD-2022-1000152 in the USB core of the Linux Kernel can lead to a hang in the usb_kill_urb function. This issue arises due to the absence of memory barriers, which can result in incorrect ordering of memory operations. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually to their Linux Kernel if updating to the latest version is not feasible. The patch can be obtained from the commit 9c61fce322ac2ef7fecf025285353570d60e41d6 in the Linux Kernel repository. By applying the patch, the memory barriers will be added to the usb_kill_urb function, addressing the vulnerability and preventing potential hangs.
Conclusion
The USB core vulnerability in the Linux Kernel, identified as GSD-2022-1000152, can potentially lead to a hang in the usb_kill_urb function. It is crucial to update the Linux Kernel to version v5.4.176 or later to mitigate this vulnerability. Alternatively, users can manually apply the provided patch to address the issue. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The USB core is a crucial component of the Linux Kernel that provides support for USB devices. It handles various USB operations, including device enumeration, data transfer, and power management.
The impact of this vulnerability is not yet proven. However, it could potentially lead to a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code with elevated privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.176 or later. Alternatively, users can manually apply the patch provided in commit 9c61fce322ac2ef7fecf025285353570d60e41d6 of the Linux Kernel repository.
Yes, users can apply the patch manually to their Linux Kernel if updating to the latest version is not feasible. The patch can be obtained from the commit 9c61fce322ac2ef7fecf025285353570d60e41d6 in the Linux Kernel repository.
For more information about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000152.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
