USB Core Hang Vulnerability in Linux Kernel
Summary
GSD-2022-1000191: USB: core: Fix hang in usb_kill_urb by adding memory barriers. Affects Kernel versions < e3b131e30e612ff0e32de6c1cb4f69f89db29193. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. USB (Universal Serial Bus) is a common interface used for connecting various devices to a computer. The USB core in the Linux Kernel handles the communication and management of USB devices. However, a vulnerability has been discovered in the USB core that can lead to a hang in the system.
Vulnerability Detail
The vulnerability in the USB core of the Linux Kernel can cause a hang in the system when attempting to kill a USB request block (URB). This hang can result in a denial-of-service (DoS) condition, where the system becomes unresponsive and fails to process further USB requests. The issue arises due to a lack of memory barriers in the code, which can lead to inconsistent state transitions and cause the system to hang. An attacker with physical access to a USB device could exploit this vulnerability to disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are strongly recommended to apply the fix by updating their Linux Kernel.
Conclusion
The USB Core Hang Vulnerability in the Linux Kernel can lead to a system hang and denial-of-service (DoS) condition. Users are advised to update their Linux Kernel to version v5.10.96 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a hang in the system, causing it to become unresponsive and fail to process USB requests. This can result in a denial-of-service (DoS) condition.
No, this vulnerability requires physical access to a USB device to exploit.
The vulnerability is present in versions prior to v5.10.96 of the Linux Kernel.
There is no known exploit for this vulnerability at the time of this report.
There is no evidence of this vulnerability being actively exploited at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
