In the Linux kernel, the following vulnerability has been resolved:
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example:
configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musbgadgetwakeup+0x1d4/0x254 [musbhdrc] ... musbgadgetwakeup [musbhdrc] from usbgadgetwakeup+0x1c/0x3c [udccore] usbgadgetwakeup [udccore] from ethstartxmit+0x3b0/0x3d4 [uether] ethstartxmit [uether] from devhardstartxmit+0x94/0x24c devhardstartxmit from schdirectxmit+0x104/0x2e4 schdirectxmit from _devqueuexmit+0x334/0xd88 _devqueuexmit from arpsolicit+0xf0/0x268 arpsolicit from neighprobe+0x54/0x7c neighprobe from _neigheventsend+0x22c/0x47c _neigheventsend from neighresolveoutput+0x14c/0x1c0 neighresolveoutput from ipfinishoutput2+0x1c8/0x628 ipfinishoutput2 from ipsendskb+0x40/0xd8 ipsendskb from udpsendskb+0x124/0x340 udpsendskb from udpsendmsg+0x780/0x984 udpsendmsg from _syssendto+0xd8/0x158 _syssendto from retfastsyscall+0x0/0x58
Let's fix the issue by checking for sendsrp() and setvbus() before calling them. For USB peripheral only cases these both could be NULL.
[
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@396e17af6761b3cc9e6e4ca94b4de7f642bfece1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-04954b30",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8398d8d735ee93a04fb9e9f490e8cacd737e3bf5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-21b68edd",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7104ba0f1958adb250319e68a15eff89ec4fd36d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-220a901e",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cc889b9dea0579726be9520fcc766077890b462",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-25f88732",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@486218c11e8d1c8f515a3bdd70d62203609d4b6b",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-306c011a",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@396e17af6761b3cc9e6e4ca94b4de7f642bfece1",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-35f0d79d",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0430bfcd46657d9116a26cd377f112cbc40826a4",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-39ae5400",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14ef61594a5a286ae0d493b8acbf9eac46fd04c4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-4ad2635f",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@486218c11e8d1c8f515a3bdd70d62203609d4b6b",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-52ab9919",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7104ba0f1958adb250319e68a15eff89ec4fd36d",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-5885a4a3",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8398d8d735ee93a04fb9e9f490e8cacd737e3bf5",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-7aeb45c8",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@486218c11e8d1c8f515a3bdd70d62203609d4b6b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-7df2eb43",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7104ba0f1958adb250319e68a15eff89ec4fd36d",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-8942e571",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cc889b9dea0579726be9520fcc766077890b462",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-89ad6c3e",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be3b82e4871ba00e9b5d0ede92d396d579d7b3b3",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-92abbdd1",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cc889b9dea0579726be9520fcc766077890b462",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-af6eea6d",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be3b82e4871ba00e9b5d0ede92d396d579d7b3b3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-b62c8825",
"signature_type": "Line"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14ef61594a5a286ae0d493b8acbf9eac46fd04c4",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-c1ec6e08",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@396e17af6761b3cc9e6e4ca94b4de7f642bfece1",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-c2863ecd",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8398d8d735ee93a04fb9e9f490e8cacd737e3bf5",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-d42d523c",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14ef61594a5a286ae0d493b8acbf9eac46fd04c4",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-d68acff4",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_set_vbus",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be3b82e4871ba00e9b5d0ede92d396d579d7b3b3",
"digest": {
"function_hash": "45205554489886473888186247905013230722",
"length": 217.0
},
"id": "CVE-2024-26600-d7bac849",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"function": "omap_usb_start_srp",
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0430bfcd46657d9116a26cd377f112cbc40826a4",
"digest": {
"function_hash": "266209846584378196990988624358465111071",
"length": 196.0
},
"id": "CVE-2024-26600-dbac49b9",
"signature_type": "Function"
},
{
"deprecated": false,
"target": {
"file": "drivers/phy/ti/phy-omap-usb2.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0430bfcd46657d9116a26cd377f112cbc40826a4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193742904238907626312401923056454424477",
"162908553981393096614554389686380932692",
"182803422093435152490578256302888568860",
"135160986825216284524892302813923113760",
"267636666259421926410248871620804599007",
"162908553981393096614554389686380932692",
"134386393332489130334672962986510816638",
"99197835154092248174058360024680472124"
]
},
"id": "CVE-2024-26600-e31a6b24",
"signature_type": "Line"
}
]