CVE-2024-57981
XHCI Linux Kernel NULL Pointer Dereference Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell ring likely is unnecessary too, but it's harmless. Leave it alone. This is probably Bug 219532, but no confirmation has been received. The issue has been independently reproduced and confirmed fixed using a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. Everything continued working normally after several prevented crashes.
INFO
Published Date :
Feb. 27, 2025, 2:15 a.m.
Last Modified :
March 13, 2025, 1:15 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the patched version.
- Verify the kernel update is applied successfully.
- Test the system for stability after the update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-57981.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-57981 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-57981
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-57981 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-57981 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 13, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/b44253956407046e5907d4d72c8fa5b93ae94485 Added Reference https://git.kernel.org/stable/c/cf30300a216a4f8dce94e11781a866a09d4b50d4 Added Reference https://git.kernel.org/stable/c/fd8bfaeba4a85b14427899adec0efb3954300653 -
Initial Analysis by [email protected]
Mar. 07, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 from (excluding) 6.13.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 from (excluding) 6.6.76 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 from (excluding) 6.12.13 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.16 from (excluding) 6.1.129 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0ce5c0dac768be14afe2426101b568a0f66bfc4d Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1e0a19912adb68a4b2b74fd77001c96cd83eb073 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4ff18870af793ce2034a6ad746e91d0a3d985b88 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ae069cd2ba09a2bd6a87a68c59ef0b7ea39cd641 Types: Mailing List, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b649f0d5bc256f691c7d234c3986685d54053de1 Types: Mailing List, Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Feb. 27, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell ring likely is unnecessary too, but it's harmless. Leave it alone. This is probably Bug 219532, but no confirmation has been received. The issue has been independently reproduced and confirmed fixed using a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. Everything continued working normally after several prevented crashes. Added Reference https://git.kernel.org/stable/c/0ce5c0dac768be14afe2426101b568a0f66bfc4d Added Reference https://git.kernel.org/stable/c/1e0a19912adb68a4b2b74fd77001c96cd83eb073 Added Reference https://git.kernel.org/stable/c/4ff18870af793ce2034a6ad746e91d0a3d985b88 Added Reference https://git.kernel.org/stable/c/ae069cd2ba09a2bd6a87a68c59ef0b7ea39cd641 Added Reference https://git.kernel.org/stable/c/b649f0d5bc256f691c7d234c3986685d54053de1