CVE-2021-46986

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: Free gadget structure only after freeing endpoints

As part of commit e81a7018d93a ("usb: dwc3: allocate gadget structure

dynamically") the dwc3_gadget_release() was added which will free

the dwc->gadget structure upon the device's removal when

usb_del_gadget_udc() is called in dwc3_gadget_exit().

However, simply freeing the gadget results a dangling pointer

situation: the endpoints created in dwc3_gadget_init_endpoints()

have their dep->endpoint.ep_list members chained off the list_head

anchored at dwc->gadget->ep_list. Thus when dwc->gadget is freed,

the first dwc3_ep in the list now has a dangling prev pointer and

likewise for the next pointer of the dwc3_ep at the tail of the list.

The dwc3_gadget_free_endpoints() that follows will result in a

use-after-free when it calls list_del().

This was caught by enabling KASAN and performing a driver unbind.

The recent commit 568262bf5492 ("usb: dwc3:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References