Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-26933— USB: core: Fix deadlock in port "disable" sysfs attribute

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于端口disable的sysfs属性中存在安全漏洞。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1059.004 · Unix Shell

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux f061f43d7418cb62b8d073e221ec75d3f5b89e17< 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05 affected
f061f43d7418cb62b8d073e221ec75d3f5b89e17< f51849833705dea5b4f9b0c8de714dd87bd6c95c affected
f061f43d7418cb62b8d073e221ec75d3f5b89e17< 4facc9421117ba9d8148c73771b213887fec77f7 affected
f061f43d7418cb62b8d073e221ec75d3f5b89e17< 73d1589b91f2099e5f6534a8497b7c6b527e064e affected
f061f43d7418cb62b8d073e221ec75d3f5b89e17< f4d1960764d8a70318b02f15203a1be2b2554ca1 affected
6.0 affected
< 6.0 unaffected
6.1.84≤ 6.1.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-26933

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
USB: core: Fix deadlock in port "disable" sysfs attribute
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if another process has locked the hub to remove it or change its configuration: Removing the hub or changing its configuration requires the hub interface to be removed, which requires the port device to be removed, and device_del() waits until all outstanding sysfs attribute callbacks for the ports have returned. The lock can't be released until then. But the disable_show() or disable_store() routine can't return until after it has acquired the lock. The resulting deadlock can be avoided by calling sysfs_break_active_protection(). This will cause the sysfs core not to wait for the attribute's callback routine to return, allowing the removal to proceed. The disadvantage is that after making this call, there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, we have to acquire a reference to it first by calling hub_get().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于端口disable的sysfs属性中存在安全漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f061f43d7418cb62b8d073e221ec75d3f5b89e17 ~ 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05 -
Linux Linux 6.0 -

II. Public POCs for CVE-2024-26933

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-26933

请登录查看更多情报信息。

Other References for CVE-2024-26933 (5)

Same Patch Batch · Linux · 2024-05-01 · 159 CVEs total

CVE-2024-27388 9.8 CRITICAL SUNRPC: fix some memleaks in gssx_dec_option_array
CVE-2024-26953 9.8 CRITICAL net: esp: fix bad handling of pages from page_pool
CVE-2024-26931 8.8 HIGH scsi: qla2xxx: Fix command flush on cable pull
CVE-2024-26990 8.8 HIGH KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
CVE-2024-27053 8.8 HIGH wifi: wilc1000: fix RCU usage in connect path
CVE-2024-26952 8.3 HIGH ksmbd: fix potencial out-of-bounds when buffer offset is invalid
CVE-2024-26936 8.2 HIGH ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
CVE-2024-27018 8.2 HIGH netfilter: br_netfilter: skip conntrack input hook for promisc packets
CVE-2024-26980 8.2 HIGH ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
CVE-2024-26954 8.1 HIGH ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
CVE-2024-26994 7.8 HIGH speakup: Avoid crash on very long word
CVE-2024-26966 7.8 HIGH clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
CVE-2024-26974 7.8 HIGH crypto: qat - resolve race condition during AER recovery
CVE-2024-26976 7.8 HIGH KVM: Always flush async #PF workqueue when vCPU is being destroyed
CVE-2024-27062 7.8 HIGH nouveau: lock the client object tree.
CVE-2024-27061 7.8 HIGH crypto: sun8i-ce - Fix use after free in unprepare
CVE-2024-26983 7.8 HIGH bootconfig: use memblock_free_late to free xbc memory to buddy
CVE-2024-27058 7.8 HIGH tmpfs: fix race on handling dquot rbtree
CVE-2024-27056 7.8 HIGH wifi: iwlwifi: mvm: ensure offloading TID queue exists
CVE-2024-27017 7.8 HIGH netfilter: nft_set_pipapo: walk over current view on netlink dump

Showing top 20 of 159 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-26933

No comments yet

Leave a comment