PT-2025-3640 · Linux+1 · Linux Kernel+1
Published
2025-01-19
·
Updated
2025-03-28
·
CVE-2024-57915
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
A vulnerability in the Linux kernel has been resolved. The issue occurs in the
u serial gadget when the gserial disconnect function clears the gser->ioport, triggering gadget reconfiguration and resulting in a null pointer access. To fix this, the ep is disabled before setting the port to null. The call trace includes functions such as gs read complete, usb gadget giveback request, and dwc3 remove requests.Recommendations
For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider disabling the
u serial gadget until a patch is available. Restrict access to the vulnerable gs read complete function to minimize the risk of exploitation. Avoid using the gser->ioport variable in the affected gadget reconfiguration until the issue is resolved.Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Suse