| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-26934: USB: core: Fix deadlock in usb_deauthorize_interface() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| USB: core: Fix deadlock in usb_deauthorize_interface() |
| |
| Among the attribute file callback routines in |
| drivers/usb/core/sysfs.c, the interface_authorized_store() function is |
| the only one which acquires a device lock on an ancestor device: It |
| calls usb_deauthorize_interface(), which locks the interface's parent |
| USB device. |
| |
| The will lead to deadlock if another process already owns that lock |
| and tries to remove the interface, whether through a configuration |
| change or because the device has been disconnected. As part of the |
| removal procedure, device_del() waits for all ongoing sysfs attribute |
| callbacks to complete. But usb_deauthorize_interface() can't complete |
| until the device lock has been released, and the lock won't be |
| released until the removal has finished. |
| |
| The mechanism provided by sysfs to prevent this kind of deadlock is |
| to use the sysfs_break_active_protection() function, which tells sysfs |
| not to wait for the attribute callback. |
| |
| Reported-and-tested by: Yue Sun <samsun1006219@gmail.com> |
| Reported by: xingwei lee <xrivendell7@gmail.com> |
| |
| The Linux kernel CVE team has assigned CVE-2024-26934 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 4.19.312 with commit 8cbdd324b41528994027128207fae8100dff094f |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 5.4.274 with commit 12d6a5681a0a5cecc2af7860f0a1613fa7c6e947 |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 5.10.215 with commit e451709573f8be904a8a72d0775bf114d7c291d9 |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 5.15.154 with commit 1b175bc579f46520b11ecda443bcd2ee4904f66a |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 6.1.84 with commit ab062fa3dc69aea88fe62162c5881ba14b50ecc5 |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 6.6.24 with commit 122a06f1068bf5e39089863f4f60b1f5d4273384 |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 6.7.12 with commit dbdf66250d2d33e8b27352fcb901de79f3521057 |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 6.8.3 with commit 07acf979da33c721357ff27129edf74c23c036c6 |
| Issue introduced in 4.4 with commit 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 and fixed in 6.9 with commit 80ba43e9f799cbdd83842fc27db667289b3150f5 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-26934 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/usb/core/sysfs.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/8cbdd324b41528994027128207fae8100dff094f |
| https://git.kernel.org/stable/c/12d6a5681a0a5cecc2af7860f0a1613fa7c6e947 |
| https://git.kernel.org/stable/c/e451709573f8be904a8a72d0775bf114d7c291d9 |
| https://git.kernel.org/stable/c/1b175bc579f46520b11ecda443bcd2ee4904f66a |
| https://git.kernel.org/stable/c/ab062fa3dc69aea88fe62162c5881ba14b50ecc5 |
| https://git.kernel.org/stable/c/122a06f1068bf5e39089863f4f60b1f5d4273384 |
| https://git.kernel.org/stable/c/dbdf66250d2d33e8b27352fcb901de79f3521057 |
| https://git.kernel.org/stable/c/07acf979da33c721357ff27129edf74c23c036c6 |
| https://git.kernel.org/stable/c/80ba43e9f799cbdd83842fc27db667289b3150f5 |
