| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025050207-CVE-2023-53054-3a00@gregkh> Date: Fri, 2 May 2025 17:55:19 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2023-53054: usb: dwc2: fix a devres leak in hw_enable upon suspend resume From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix a devres leak in hw_enable upon suspend resume Each time the platform goes to low power, PM suspend / resume routines call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). This adds a new devres each time. This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from udc_start(). This can be seen with tracing: - echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable - go to low power - cat /sys/kernel/debug/tracing/trace A new "ADD" entry is found upon each low power cycle: ... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) ... A second issue is addressed here: - regulator_bulk_enable() is called upon each PM cycle (suspend/resume). - regulator_bulk_disable() never gets called. So the reference count for these regulators constantly increase, by one upon each low power cycle, due to missing regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable(). The original fix that introduced the devm_add_action_or_reset() call, fixed an issue during probe, that happens due to other errors in dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without disabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL. Rather fix the error path: disable all the low level hardware in the error path, by using the "hsotg->ll_hw_enabled" flag. Checking dr_mode has been introduced to avoid a dual call to dwc2_lowlevel_hw_disable(). "ll_hw_enabled" should achieve the same (and is used currently in the remove() routine). The Linux kernel CVE team has assigned CVE-2023-53054 to this issue. Affected and fixed versions =========================== Issue introduced in 5.9 with commit 33a06f1300a79cfd461cea0268f05e969d4f34ec and fixed in 5.10.177 with commit 1f01027c51eb16145e8e07fafea3ca07ef102d06 Issue introduced in 5.9 with commit 33a06f1300a79cfd461cea0268f05e969d4f34ec and fixed in 5.15.105 with commit cba76e1fb896b573f09f51aa299223276a77bc90 Issue introduced in 5.9 with commit 33a06f1300a79cfd461cea0268f05e969d4f34ec and fixed in 6.1.22 with commit ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d Issue introduced in 5.9 with commit 33a06f1300a79cfd461cea0268f05e969d4f34ec and fixed in 6.2.9 with commit 6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c Issue introduced in 5.9 with commit 33a06f1300a79cfd461cea0268f05e969d4f34ec and fixed in 6.3 with commit f747313249b74f323ddf841a9c8db14d989f296a Issue introduced in 4.4.233 with commit c95e1f67b9a84479d1a6d2e9b123a1553af2a75e Issue introduced in 4.9.233 with commit 7d2a4749e1589295c69183f7d79d5b62664b34d6 Issue introduced in 4.14.194 with commit 8a8841b9f3eb1f46e3fc6d56a9b9299c53f4f86f Issue introduced in 4.19.140 with commit fa7fd9ba18533e9aa5f718a06de3deb522a4b587 Issue introduced in 5.4.59 with commit b2c2b88b049684b89776036f9a03fcc2d1bb3c22 Issue introduced in 5.7.16 with commit e7c4b79d70a70b4b7b0a04c640238a2ef0a7a8c8 Issue introduced in 5.8.2 with commit 88dcd13872b11bd60e6d4cb6317821e1d367e524 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53054 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/usb/dwc2/platform.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1f01027c51eb16145e8e07fafea3ca07ef102d06 https://git.kernel.org/stable/c/cba76e1fb896b573f09f51aa299223276a77bc90 https://git.kernel.org/stable/c/ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d https://git.kernel.org/stable/c/6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c https://git.kernel.org/stable/c/f747313249b74f323ddf841a9c8db14d989f296a
Powered by blists - more mailing lists