CVE-2024-42085

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock

When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system

to enter suspend status with below command:

echo mem > /sys/power/state

There will be a deadlock issue occurring. Detailed invoking path as

below:

dwc3_suspend_common()

spin_lock_irqsave(&dwc->lock, flags); <-- 1st

dwc3_gadget_suspend(dwc);

dwc3_gadget_soft_disconnect(dwc);

spin_lock_irqsave(&dwc->lock, flags); <-- 2nd

This issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix

NULL pointer dereference in dwc3_gadget_suspend") that removes the code

of checking whether dwc->gadget_driver is NULL or not. It causes the

following code is executed and deadlock occurs when trying to get the

spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3:

Remove DWC3 locking during gadget suspend/resume")

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References