| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-46674: usb: dwc3: st: fix probed platform device ref count on probe error path |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| usb: dwc3: st: fix probed platform device ref count on probe error path |
| |
| The probe function never performs any paltform device allocation, thus |
| error path "undo_platform_dev_alloc" is entirely bogus. It drops the |
| reference count from the platform device being probed. If error path is |
| triggered, this will lead to unbalanced device reference counts and |
| premature release of device resources, thus possible use-after-free when |
| releasing remaining devm-managed resources. |
| |
| The Linux kernel CVE team has assigned CVE-2024-46674 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 4.19.321 with commit b0979a885b9d4df2a25b88e9d444ccaa5f9f495c |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 5.4.283 with commit f3498650df0805c75b4e1c94d07423c46cbf4ce1 |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 5.10.225 with commit 6aee4c5635d81f4809c3b9f0c198a65adfbb2ada |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 5.15.166 with commit 060f41243ad7f6f5249fa7290dda0c01f723d12d |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 6.1.108 with commit 4c6735299540f3c82a5033d35be76a5c42e0fb18 |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 6.6.49 with commit e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49 |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 6.10.8 with commit 1de989668708ce5875efc9d669d227212aeb9a90 |
| Issue introduced in 3.18 with commit f83fca0707c66e36f14efef7f68702cb12de70b7 and fixed in 6.11 with commit ddfcfeba891064b88bb844208b43bef2ef970f0c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-46674 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/usb/dwc3/dwc3-st.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c |
| https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1 |
| https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada |
| https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d |
| https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18 |
| https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49 |
| https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90 |
| https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c |
