CVE-2024-26715: linux-libc-dev - Fix NULL pointer dereference in dwc3_gadget_suspend
Summary
CVE-2024-26715: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend In current scenario if Plug-out and Plug-In performed continuously there could be... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build software that interacts with the Linux kernel. This package is vulnerable to a NULL pointer dereference in the dwc3_gadget_suspend function of the usb-dwc3-gadget driver. This vulnerability can be triggered when performing continuous plug-out and plug-in operations, leading to a NULL pointer dereference and potential system instability.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from a race condition between two CPU cores. When one core clears the dwc->gadget_driver variable, another core may execute the dwc3_gadget_suspend function and access the variable before it is cleared. This can result in a NULL pointer dereference and subsequent system crash. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition. The vulnerability has been fixed in the latest version of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the linux-libc-dev package to the latest version.
Conclusion
The linux-libc-dev package is vulnerable to a NULL pointer dereference in the dwc3_gadget_suspend function. This vulnerability can be triggered by performing continuous plug-out and plug-in operations. It is recommended to update the package to version 6.1.90-1 or later to fix the vulnerability. No known workaround is available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the Linux kernel headers for development. It is used to compile and build software that interacts with the Linux kernel.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a pointer that is not pointing to a valid memory location (i.e., it is NULL). This can lead to crashes or other unexpected behavior.
An attacker would need local access to the system and the ability to perform continuous plug-out and plug-in operations. By triggering the race condition between CPU cores, they could cause a NULL pointer dereference and potentially crash the system.
Yes, the vulnerability has been fixed in version 6.1.90-1 of the linux-libc-dev package. It is recommended to update to this version or later to mitigate the vulnerability.
Yes, you can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will analyze it for vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
