USB: dwc2 - Potential Security Vulnerability in Linux Kernel
Summary
UVI-2021-1001633: usb: dwc2: check return value after calling platform_get_resource(). Affects Kernel versions < 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system that serves as the foundation for various Linux distributions. It provides essential functionality and device drivers for hardware components. One of the components included in the Linux Kernel is the dwc2 USB driver, which handles communication with USB devices. This driver is responsible for managing the USB controller and facilitating data transfer between the host system and connected USB devices.
Vulnerability Detail
The identified vulnerability in the dwc2 USB driver is related to a missing check for the return value after calling platform_get_resource(). This oversight could potentially lead to security issues. Although the exact impact and attack vectors have not been proven, it is crucial to address this vulnerability to ensure the overall security of the system. The vulnerability has been assigned the ID UVI-2021-1001633 and is fixed in Linux Kernel version v5.10.72 by commit 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the dwc2 USB driver in the Linux Kernel is vulnerable to a missing check for the return value after calling platform_get_resource(). To ensure the security of the system, it is recommended to update the Linux Kernel to version v5.10.72 or later, which includes the necessary fix for this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is not yet proven. However, it is essential to address it to prevent potential security issues and ensure the overall security of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version to mitigate the vulnerability.
You can find more information about the fix for this vulnerability in the Linux Kernel repository. The commit 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262 addresses this vulnerability.
The vulnerability details were discovered and reported by an automated process. The actual impact and attack plausibility have not been proven.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
