CVE-2023-53580

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

USB: Gadget: core: Help prevent panic during UVC unconfigure

Avichal Rakesh reported a kernel panic that occurred when the UVC

gadget driver was removed from a gadget's configuration. The panic

involves a somewhat complicated interaction between the kernel driver

and a userspace component (as described in the Link tag below), but

the analysis did make one thing clear: The Gadget core should

accomodate gadget drivers calling usb_gadget_deactivate() as part of

their unbind procedure.

Currently this doesn't work. gadget_unbind_driver() calls

driver->unbind() while holding the udc->connect_lock mutex, and

usb_gadget_deactivate() attempts to acquire that mutex, which will

result in a deadlock.

The simple fix is for gadget_unbind_driver() to release the mutex when

invoking the ->unbind() callback. There is no particular reason for

it to be holding the mutex at that time, and the mutex isn't held

while the ->bind() cal

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References