CVE-2024-53070
"Linux Kernel USB DWC3 Runtime Suspension Crashing Vulnerability"
Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix fault at system suspend if device was already runtime suspended If the device was already runtime suspended then during system suspend we cannot access the device registers else it will crash. Also we cannot access any registers after dwc3_core_exit() on some platforms so move the dwc3_enable_susphy() call to the top.
INFO
Published Date :
Nov. 19, 2024, 6:15 p.m.
Last Modified :
Nov. 25, 2024, 8:53 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-53070.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-53070 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-53070 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 25, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.170 up to (excluding) 5.15.172 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.115 up to (excluding) 6.1.117 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.59 up to (excluding) 6.6.61 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.11.5 up to (excluding) 6.11.8 Changed Reference Type https://git.kernel.org/stable/c/06b98197b69e2f2af9cb1991ee0b1c876edf7b86 No Types Assigned https://git.kernel.org/stable/c/06b98197b69e2f2af9cb1991ee0b1c876edf7b86 Patch Changed Reference Type https://git.kernel.org/stable/c/4abc5ee334fe4aba50461c45fdaaa4c5e5c57789 No Types Assigned https://git.kernel.org/stable/c/4abc5ee334fe4aba50461c45fdaaa4c5e5c57789 Patch Changed Reference Type https://git.kernel.org/stable/c/562804b1561cc248cc37746a1c96c83cab1d7209 No Types Assigned https://git.kernel.org/stable/c/562804b1561cc248cc37746a1c96c83cab1d7209 Patch Changed Reference Type https://git.kernel.org/stable/c/9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b No Types Assigned https://git.kernel.org/stable/c/9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b Patch Changed Reference Type https://git.kernel.org/stable/c/d9e65d461a9de037e7c9d584776d025cfce6d86d No Types Assigned https://git.kernel.org/stable/c/d9e65d461a9de037e7c9d584776d025cfce6d86d Patch -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 19, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix fault at system suspend if device was already runtime suspended If the device was already runtime suspended then during system suspend we cannot access the device registers else it will crash. Also we cannot access any registers after dwc3_core_exit() on some platforms so move the dwc3_enable_susphy() call to the top. Added Reference kernel.org https://git.kernel.org/stable/c/d9e65d461a9de037e7c9d584776d025cfce6d86d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/562804b1561cc248cc37746a1c96c83cab1d7209 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4abc5ee334fe4aba50461c45fdaaa4c5e5c57789 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/06b98197b69e2f2af9cb1991ee0b1c876edf7b86 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-53070 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-53070
weaknesses.