USB: dwc3-meson-g12a: Fix USB2 PHY glue init when phy0 is disabled
Summary
UVI-2021-1000953: usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled. Affects Kernel versions >= 013af227f58a97ffc61b99301f8f4448dc7e7f55, < 750a0d75564293be3ed50f13ef7f38ab75106421. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The USB package in the Linux Kernel is responsible for managing USB devices and their communication with the system. It includes various drivers for USB controllers, such as the dwc3-meson-g12a driver. This driver is specifically designed for the Amlogic Meson G12A SoC family, which is commonly used in multimedia devices. The dwc3-meson-g12a driver handles the initialization and operation of the USB controller on these devices.
Vulnerability Detail
The vulnerability identified as UVI-2021-1000953 affects the dwc3-meson-g12a driver in the Linux Kernel. When the phy0 (USB2 PHY) is disabled, the USB2 PHY glue initialization is not properly handled. This can lead to various issues, including potential security vulnerabilities. The exact impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The USB package in the Linux Kernel, specifically the dwc3-meson-g12a driver, is vulnerable to a security issue when the phy0 (USB2 PHY) is disabled. This vulnerability has been fixed in the Linux Kernel version v5.10.44. Users are advised to update their Linux Kernel to this version or later to ensure the vulnerability is addressed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is not yet proven. However, it could potentially lead to security vulnerabilities in systems using the dwc3-meson-g12a driver with disabled phy0 (USB2 PHY).
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including UVI-2021-1000953.
Yes, the vulnerability has been fixed in the Linux Kernel version v5.10.44 by commit 750a0d75564293be3ed50f13ef7f38ab75106421. Users should update their Linux Kernel to this version or later to apply the patch.
No specific mitigation method is mentioned for this vulnerability. It is recommended to update the Linux Kernel to the fixed version to ensure the vulnerability is properly addressed.
You can find more information about this vulnerability in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability entry can be accessed at: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000953.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
