Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-45006— xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于xhci组件存在空指针解引用漏洞。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.25% · P16

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 651aaf36a7d7b36a58980e70133f9437d4f6d312< ef0a0e616b2789bb804a0ce5e161db03170a85b6 affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< a57b0ebabe6862dce0a2e0f13e17941ad72fc56b affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< 0f0654318e25b2c185e245ba4a591e42fabb5e59 affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< 365ef7c4277fdd781a695c3553fa157d622d805d affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< 5ad898ae82412f8a689d59829804bff2999dd0ea affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< 6b99de301d78e1f5249e57ef2c32e1dec3df2bb1 affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< 8fb9d412ebe2f245f13481e4624b40e651570cbd affected
651aaf36a7d7b36a58980e70133f9437d4f6d312< af8e119f52e9c13e556be9e03f27957554a84656 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-45006

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于xhci组件存在空指针解引用漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 651aaf36a7d7b36a58980e70133f9437d4f6d312 ~ ef0a0e616b2789bb804a0ce5e161db03170a85b6 -
Linux Linux 4.15 -

II. Public POCs for CVE-2024-45006

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-45006

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-45006 (8)

Same Patch Batch · Linux · 2024-09-04 · 58 CVEs total

CVE-2024-44984 10.0 CRITICAL bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
CVE-2024-44998 9.8 CRITICAL atm: idt77252: prevent use after free in dequeue_rx()
CVE-2024-44985 9.8 CRITICAL ipv6: prevent possible UAF in ip6_xmit()
CVE-2024-44970 9.8 CRITICAL net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
CVE-2024-44994 8.8 HIGH iommu: Restore lost return in iommu_report_device_fault()
CVE-2024-44988 8.8 HIGH net: dsa: mv88e6xxx: Fix out-of-bound access
CVE-2024-44986 8.1 HIGH ipv6: fix possible UAF in ip6_finish_output2()
CVE-2024-44973 8.1 HIGH mm, slub: do not call do_slab_free for kfence object
CVE-2024-44966 7.8 HIGH binfmt_flat: Fix corruption when not offsetting data start
CVE-2024-44949 7.8 HIGH parisc: fix a possible DMA corruption
CVE-2024-44959 7.8 HIGH tracefs: Use generic inode RCU for synchronizing freeing
CVE-2024-44951 7.8 HIGH serial: sc16is7xx: fix TX fifo corruption
CVE-2024-44954 7.8 HIGH ALSA: line6: Fix racy access to midibuf
CVE-2024-44967 7.8 HIGH drm/mgag200: Bind I2C lifetime to DRM device
CVE-2024-44974 7.8 HIGH mptcp: pm: avoid possible UaF when selecting endp
CVE-2024-44978 7.8 HIGH drm/xe: Free job before xe_exec_queue_put
CVE-2024-44987 7.8 HIGH ipv6: prevent UAF in ip6_send_skb()
CVE-2024-44995 7.8 HIGH net: hns3: fix a deadlock problem when config TC during resetting
CVE-2024-44997 7.8 HIGH net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
CVE-2024-45000 7.8 HIGH fs/netfs/fscache_cookie: add missing "n_accesses" check

Showing top 20 of 58 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-45006

No comments yet

Leave a comment