USB xHCI-Plat Remote Wake Enable Crash
Summary
GSD-2022-1000249: usb: xhci-plat: fix crash when suspend if remote wake enable. Affects Kernel versions < d5755832a1e47f5d8773f0776e211ecd4e02da72. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USB xHCI-Plat is a component of the Linux Kernel that provides support for USB 3.0 and later versions. It is responsible for managing USB host controllers and devices. One of the features of the xHCI-Plat is the ability to enable remote wake, which allows a suspended USB device to wake up the system. However, a vulnerability has been discovered in the xHCI-Plat that can lead to a crash when the system is suspended with remote wake enabled.
Vulnerability Detail
The vulnerability in the USB xHCI-Plat occurs when the system is suspended and remote wake is enabled. This can cause a crash, potentially leading to a denial of service (DoS) condition. The exact technical details of the vulnerability have not been provided, but it is fixed in Linux Kernel version v5.15.19 by commit d5755832a1e47f5d8773f0776e211ecd4e02da72. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The USB xHCI-Plat vulnerability can lead to a system crash when the system is suspended with remote wake enabled. It is recommended to update the Linux Kernel to version v5.15.19 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is a potential denial of service (DoS) condition, as the system can crash when suspended with remote wake enabled.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in Linux Kernel version v5.15.19. It is recommended to update to this version or later to fix the vulnerability.
The exact attack plausibility of this vulnerability has not been proven. However, as it relates to USB functionality, it is possible that an attacker could exploit it remotely if they have access to the USB device and the system is configured to allow remote wake.
You can find more information about this vulnerability in the Open Source Vulnerability Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000249.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
