linux-cve-announce - CVE-2024-56670: usb: gadget: u_serial: Fix the issue that gs_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122755-CVE-2024-56670-929d@gregkh>
Date: Fri, 27 Dec 2024 16:07:07 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-56670: usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer

Considering that in some extreme cases,
when u_serial driver is accessed by multiple threads,
Thread A is executing the open operation and calling the gs_open,
Thread B is executing the disconnect operation and calling the
gserial_disconnect function,The port->port_usb pointer will be set to NULL.

E.g.
    Thread A                                 Thread B
    gs_open()                                gadget_unbind_driver()
    gs_start_io()                            composite_disconnect()
    gs_start_rx()                            gserial_disconnect()
    ...                                      ...
    spin_unlock(&port->port_lock)
    status = usb_ep_queue()                  spin_lock(&port->port_lock)
    spin_lock(&port->port_lock)              port->port_usb = NULL
    gs_free_requests(port->port_usb->in)     spin_unlock(&port->port_lock)
    Crash

This causes thread A to access a null pointer (port->port_usb is null)
when calling the gs_free_requests function, causing a crash.

If port_usb is NULL, the release request will be skipped as it
will be done by gserial_disconnect.

So add a null pointer check to gs_start_io before attempting
to access the value of the pointer port->port_usb.

Call trace:
 gs_start_io+0x164/0x25c
 gs_open+0x108/0x13c
 tty_open+0x314/0x638
 chrdev_open+0x1b8/0x258
 do_dentry_open+0x2c4/0x700
 vfs_open+0x2c/0x3c
 path_openat+0xa64/0xc60
 do_filp_open+0xb8/0x164
 do_sys_openat2+0x84/0xf0
 __arm64_sys_openat+0x70/0x9c
 invoke_syscall+0x58/0x114
 el0_svc_common+0x80/0xe0
 do_el0_svc+0x1c/0x28
 el0_svc+0x38/0x68

The Linux kernel CVE team has assigned CVE-2024-56670 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 5.4.288 with commit 4efdfdc32d8d6307f968cd99f1db64468471bab1
	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 5.10.232 with commit 28b3c03a6790de1f6f2683919ad657840f0f0f58
	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 5.15.175 with commit 1247e1df086aa6c17ab53cd1bedce70dd7132765
	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 6.1.121 with commit c83213b6649d22656b3a4e92544ceeea8a2c6c07
	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 6.6.67 with commit 8ca07a3d18f39b1669927ef536e485787e856df6
	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 6.12.6 with commit dd6b0ca6025f64ccb465a6a3460c5b0307ed9c44
	Issue introduced in 2.6.27 with commit c1dca562be8ada614ef193aa246c6f8705bcd6b9 and fixed in 6.13-rc3 with commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56670
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/function/u_serial.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4efdfdc32d8d6307f968cd99f1db64468471bab1
	https://git.kernel.org/stable/c/28b3c03a6790de1f6f2683919ad657840f0f0f58
	https://git.kernel.org/stable/c/1247e1df086aa6c17ab53cd1bedce70dd7132765
	https://git.kernel.org/stable/c/c83213b6649d22656b3a4e92544ceeea8a2c6c07
	https://git.kernel.org/stable/c/8ca07a3d18f39b1669927ef536e485787e856df6
	https://git.kernel.org/stable/c/dd6b0ca6025f64ccb465a6a3460c5b0307ed9c44
	https://git.kernel.org/stable/c/4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b