PT-2024-5403 · Linux+6 · Linux Kernel+6
Published
2024-05-10
·
Updated
2025-10-01
·
CVE-2024-36977
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The issue is related to a race condition in the
dwc3 stop active transfer() function, which can lead to SMMU faults. This occurs when an IN request is queued and soft disconnect is called, causing stop active transfer to be called with IOC cleared. As a result, send gadget ep cmd() skips waiting for CMDACT to be cleared during EndXfer, leading to potential faults. The vulnerability is associated with controller IP/revisions except DWC3 usb3 >= 310a, which supports the GUCTL2[14: Rst actbitlater] bit for polling CMDACT.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider adding a 1ms delay in the
dwc3 stop active transfer() function to ensure ENDXFER completion.Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu