In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: core: Prevent USB core invalid event buffer address access
This commit addresses an issue where the USB core could access an invalid event buffer address during runtime suspend, potentially causing SMMU faults and other memory issues in Exynos platforms. The problem arises from the following sequence. 1. In dwc3gadgetsuspend, there is a chance of a timeout when moving the USB core to the halt state after clearing the run/stop bit by software. 2. In dwc3coreexit, the event buffer is cleared regardless of the USB core's status, which may lead to an SMMU faults and other memory issues. if the USB core tries to access the event buffer address.
To prevent this hardware quirk on Exynos platforms, this commit ensures that the event buffer address is not cleared by software when the USB core is active during runtime suspend by checking its status before clearing the buffer address.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e23f6ad8d110bf632f7471482e10b43dc174fb72",
"id": "CVE-2024-46675-04bc1852",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72da4d89b97da71e056cc4d1429b2bc426a9c2f",
"id": "CVE-2024-46675-0c302ea5",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@111277b881def3153335acfe0d1f43e6cd83ac93",
"id": "CVE-2024-46675-1555cd34",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bb11a75dd4d3612378b90e2a4aa49bdccea28ab",
"id": "CVE-2024-46675-32716ea2",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@111277b881def3153335acfe0d1f43e6cd83ac93",
"id": "CVE-2024-46675-51ba2334",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2189fd13c577d7881f94affc09c950a795064c4b",
"id": "CVE-2024-46675-7a5b3bc9",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eca3f543f817da87c00d1a5697b473efb548204f",
"id": "CVE-2024-46675-7c0041b3",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eca3f543f817da87c00d1a5697b473efb548204f",
"id": "CVE-2024-46675-8476a243",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e23f6ad8d110bf632f7471482e10b43dc174fb72",
"id": "CVE-2024-46675-87ec261f",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2afc2bffec77316b90d530b07695e3f534df914",
"id": "CVE-2024-46675-9879b86c",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14e497183df28c006603cc67fd3797a537eef7b9",
"id": "CVE-2024-46675-a6c09589",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bb11a75dd4d3612378b90e2a4aa49bdccea28ab",
"id": "CVE-2024-46675-c4b86a9f",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2afc2bffec77316b90d530b07695e3f534df914",
"id": "CVE-2024-46675-d01a59a3",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2189fd13c577d7881f94affc09c950a795064c4b",
"id": "CVE-2024-46675-ee62ead3",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14e497183df28c006603cc67fd3797a537eef7b9",
"id": "CVE-2024-46675-ef2e5c5f",
"target": {
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"305788096731813240358092132620057518456",
"336558753749477104525688983874825623046",
"331089821421509209670736025864917627000",
"97035049089103301499501046713052604441",
"163138417079361529512538039873235812011",
"149934286966942049048119901790102186681"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72da4d89b97da71e056cc4d1429b2bc426a9c2f",
"id": "CVE-2024-46675-f4c48d6e",
"target": {
"function": "dwc3_event_buffers_cleanup",
"file": "drivers/usb/dwc3/core.c"
},
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "177461211097573280250769698435989558553",
"length": 363.0
},
"deprecated": false
}
]