Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-36894— usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 usb:gadget:f_fs 模块存在竞争条件漏洞。

CVSS 7.8 · High EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 2e4c7553cd6f9c68bb741582dcb614edcbeca70f< f71a53148ce34898fef099b75386a3a9f4449311 affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< 9e72ef59cbe61cd1243857a6418ca92104275867 affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< e500b1c4e29ad0bd1c1332a1eaea2913627a92dd affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< 3613e5023f09b3308545e9d1acda86017ebd418a affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< a0fdccb1c9e027e3195f947f61aa87d6d0d2ea14 affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< 73c05ad46bb4fbbdb346004651576d1c8dbcffbb affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< d7461830823242702f5d84084bcccb25159003f4 affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f< 24729b307eefcd7c476065cd7351c1a018082c19 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-36894

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disconnect. For a DWC3 based implementation, the callstack looks like the following: DWC3 Gadget FFS Application dwc3_gadget_soft_disconnect() ... --> dwc3_stop_active_transfers() --> dwc3_gadget_giveback(-ESHUTDOWN) --> ffs_epfile_async_io_complete() ffs_aio_cancel() --> usb_ep_free_request() --> usb_ep_dequeue() There is currently no locking implemented between the AIO completion handler and AIO cancel, so the issue occurs if the completion routine is running in parallel to an AIO cancel call coming from the FFS application. As the completion call frees the USB request (io_data->req) the FFS application is also referencing it for the usb_ep_dequeue() call. This can lead to accessing a stale/hanging pointer. commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") relocated the usb_ep_free_request() into ffs_epfile_async_io_complete(). However, in order to properly implement locking to mitigate this issue, the spinlock can't be added to ffs_epfile_async_io_complete(), as usb_ep_dequeue() (if successfully dequeuing a USB request) will call the function driver's completion handler in the same context. Hence, leading into a deadlock. Fix this issue by moving the usb_ep_free_request() back to ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req to NULL after freeing it within the ffs->eps_lock. This resolves the race condition above, as the ffs_aio_cancel() routine will not continue attempting to dequeue a request that has already been freed, or the ffs_user_copy_work() not freeing the USB request until the AIO cancel is done referencing it. This fix depends on commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 usb:gadget:f_fs 模块存在竞争条件漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 2e4c7553cd6f9c68bb741582dcb614edcbeca70f ~ f71a53148ce34898fef099b75386a3a9f4449311 -
Linux Linux 3.15 -

II. Public POCs for CVE-2024-36894

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-36894

请登录查看更多情报信息。

Other References for CVE-2024-36894 (7)

Same Patch Batch · Linux · 2024-05-30 · 93 CVEs total

CVE-2024-36958 9.8 CRITICAL NFSD: Fix nfsd4_encode_fattr4() crasher
CVE-2024-36886 9.8 CRITICAL tipc: fix UAF in error path
CVE-2024-36911 9.8 CRITICAL hv_netvsc: Don't free decrypted memory
CVE-2024-36912 9.6 CRITICAL Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
CVE-2024-36913 9.3 CRITICAL Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
CVE-2024-36909 9.3 CRITICAL Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
CVE-2024-36922 8.8 HIGH wifi: iwlwifi: read txq->read_ptr under lock
CVE-2024-36921 8.8 HIGH wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-2024-36910 8.4 HIGH uio_hv_generic: Don't free decrypted memory
CVE-2024-36032 8.1 HIGH Bluetooth: qca: fix info leak when fetching fw build id
CVE-2024-36933 7.8 HIGH nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
CVE-2024-36904 7.8 HIGH tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
CVE-2024-36914 7.8 HIGH drm/amd/display: Skip on writeback when it's not applicable
CVE-2024-36918 7.8 HIGH bpf: Check bloom filter map value size
CVE-2024-36018 7.8 HIGH nouveau/uvmm: fix addr/range calcs for remap operations
CVE-2024-36890 7.8 HIGH mm/slab: make __free(kfree) accept error pointers
CVE-2024-36940 7.8 HIGH pinctrl: core: delete incorrect free in pinctrl_enable()
CVE-2024-36884 7.8 HIGH iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
CVE-2024-36928 7.8 HIGH s390/qeth: Fix kernel panic after setting hsuid
CVE-2024-36883 7.8 HIGH net: fix out-of-bounds access in ops_init

Showing top 20 of 93 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-36894

No comments yet

Leave a comment