In the Linux kernel, the following vulnerability has been resolved:
xhci: Fix null pointer dereference when host dies
Make sure xhcifreedev() and xhcikillendpoint_urbs() do not race and cause null pointer dereference when host suddenly dies.
Usb core may call xhcifreedev() which frees the xhci->devs[slotid] virt device at the same time that xhcikillendpointurbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back.
hold the xhci spinlock while freeing the virt device
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1",
"id": "CVE-2023-52898-1596c8c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22567902534575788370566944024557306208",
"142762987463951927149661140868673610686",
"9878596470058630279203506787583708868",
"247477551858322433526118590701267256769",
"21256543999695718971939525820073883860",
"68523994246648832737693724857805388102",
"88693767864285784933077653093612156270",
"119681356082920361862828582086110019233",
"271144770259627809244473229678477430177"
]
},
"target": {
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1",
"id": "CVE-2023-52898-3fb5eacc",
"digest": {
"function_hash": "227547483416872168454465937861627973236",
"length": 721.0
},
"target": {
"function": "xhci_free_dev",
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea2ee5e9991caf74e0604f994c1831a5867055b2",
"id": "CVE-2023-52898-4dda2d78",
"digest": {
"function_hash": "281718624862465615629435625170102930293",
"length": 626.0
},
"target": {
"function": "xhci_free_dev",
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c462ac871f49753eca86bb960f573b993976a5ea",
"id": "CVE-2023-52898-54cecd0e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22567902534575788370566944024557306208",
"142762987463951927149661140868673610686",
"9878596470058630279203506787583708868",
"247477551858322433526118590701267256769",
"150211428504647950541511162604570275783",
"301951948792555551582989517476590268308",
"88693767864285784933077653093612156270",
"119681356082920361862828582086110019233",
"271144770259627809244473229678477430177"
]
},
"target": {
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c462ac871f49753eca86bb960f573b993976a5ea",
"id": "CVE-2023-52898-62b84c0a",
"digest": {
"function_hash": "21746445452888594042946206480519810120",
"length": 683.0
},
"target": {
"function": "xhci_free_dev",
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea2ee5e9991caf74e0604f994c1831a5867055b2",
"id": "CVE-2023-52898-7e08697b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22567902534575788370566944024557306208",
"142762987463951927149661140868673610686",
"9878596470058630279203506787583708868",
"247477551858322433526118590701267256769",
"134788996230096330915274167395129362727",
"50658076634056179973538888825312277093",
"88693767864285784933077653093612156270",
"119681356082920361862828582086110019233",
"271144770259627809244473229678477430177"
]
},
"target": {
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@081105213ff6f661c114781d469233c7d0e09c2e",
"id": "CVE-2023-52898-8a8fcd92",
"digest": {
"function_hash": "21746445452888594042946206480519810120",
"length": 683.0
},
"target": {
"function": "xhci_free_dev",
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@081105213ff6f661c114781d469233c7d0e09c2e",
"id": "CVE-2023-52898-93bb6f11",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22567902534575788370566944024557306208",
"142762987463951927149661140868673610686",
"9878596470058630279203506787583708868",
"247477551858322433526118590701267256769",
"150211428504647950541511162604570275783",
"301951948792555551582989517476590268308",
"88693767864285784933077653093612156270",
"119681356082920361862828582086110019233",
"271144770259627809244473229678477430177"
]
},
"target": {
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@133b902378e4acbd824c29dd0d48570ad596e368",
"id": "CVE-2023-52898-a91934fb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22567902534575788370566944024557306208",
"142762987463951927149661140868673610686",
"9878596470058630279203506787583708868",
"247477551858322433526118590701267256769",
"150211428504647950541511162604570275783",
"301951948792555551582989517476590268308",
"88693767864285784933077653093612156270",
"119681356082920361862828582086110019233",
"271144770259627809244473229678477430177"
]
},
"target": {
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@133b902378e4acbd824c29dd0d48570ad596e368",
"id": "CVE-2023-52898-c16f5e9e",
"digest": {
"function_hash": "21746445452888594042946206480519810120",
"length": 683.0
},
"target": {
"function": "xhci_free_dev",
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2bc47c43e70cf904b1af49f76d572326c08bca7",
"id": "CVE-2023-52898-cabca4f7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22567902534575788370566944024557306208",
"142762987463951927149661140868673610686",
"9878596470058630279203506787583708868",
"247477551858322433526118590701267256769",
"134788996230096330915274167395129362727",
"50658076634056179973538888825312277093",
"88693767864285784933077653093612156270",
"119681356082920361862828582086110019233",
"271144770259627809244473229678477430177"
]
},
"target": {
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2bc47c43e70cf904b1af49f76d572326c08bca7",
"id": "CVE-2023-52898-e5e5d04c",
"digest": {
"function_hash": "281718624862465615629435625170102930293",
"length": 626.0
},
"target": {
"function": "xhci_free_dev",
"file": "drivers/usb/host/xhci.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]