PT-2024-29740 · Linux+6 · Linux Kernel+6
Meng Li
·
Published
2024-06-18
·
Updated
2025-09-29
·
CVE-2024-42085
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A deadlock issue occurs in the Linux kernel when the
CONFIG USB DWC3 DUAL ROLE configuration is selected and the system is triggered to enter suspend status with the command echo mem > /sys/power/state. The issue is exposed by a commit that removes the code checking whether dwc->gadget driver is NULL or not, causing a deadlock when trying to get the spinlock. The root cause is another commit that forgot to remove the lock of otg mode during gadget suspend/resume. The detailed invoking path involves the functions dwc3 suspend common(), dwc3 gadget suspend(dwc), and dwc3 gadget soft disconnect(dwc), with the spin lock irqsave(&dwc->lock, flags) being called twice, leading to the deadlock.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu