In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: Fix looping of queued SG entries
The dwc3request->numqueuedsgs is decremented on completion. If a partially completed request is handled, then the dwc3request->numqueuedsgs no longer reflects the total number of numqueuedsgs (it would be cleared).
Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry.
[
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1161.0,
"function_hash": "251363602146196976115748831539374801931"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ceb21d76426bbe7072cc3e43281e70c0d664cc7",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-3d29d252"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0247da93bf62d33304b7bf97850ebf2a86e06d28",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-5255446b"
},
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1161.0,
"function_hash": "251363602146196976115748831539374801931"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9e72352a10ae89a430449f7bfeb043e75c255d9",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-57408f50"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ceb21d76426bbe7072cc3e43281e70c0d664cc7",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-5b77e9a3"
},
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1327.0,
"function_hash": "36496567554083637216470119514791514451"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70777a23a54e359cfdfafc625a57cd56434f3859",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-69ff7e33"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7c3d0b59213ebeedff63d128728ce0b3d7a51ec",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-77e7687f"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70777a23a54e359cfdfafc625a57cd56434f3859",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-8eb2e285"
},
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1327.0,
"function_hash": "36496567554083637216470119514791514451"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7c3d0b59213ebeedff63d128728ce0b3d7a51ec",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-94febb10"
},
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1327.0,
"function_hash": "36496567554083637216470119514791514451"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1534f6f69393aac773465d80d31801b554352627",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-b006a8f3"
},
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1161.0,
"function_hash": "251363602146196976115748831539374801931"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0247da93bf62d33304b7bf97850ebf2a86e06d28",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-b33e496c"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9e72352a10ae89a430449f7bfeb043e75c255d9",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-b47b036e"
},
{
"target": {
"function": "dwc3_prepare_trbs_sg",
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"length": 1327.0,
"function_hash": "36496567554083637216470119514791514451"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7fc65f5141c24785dc8c19249ca4efcf71b3524",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-56698-d3d1cf84"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7fc65f5141c24785dc8c19249ca4efcf71b3524",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-d5766202"
},
{
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"digest": {
"line_hashes": [
"179676168000645826212606549912105580615",
"205899084485770688531904161481066250970",
"311905989808831650904210965430586475875",
"123351233967622798517970730542597120758",
"324287089903565485371709239818163897369",
"298255813992184209565227365512963305702",
"89543862475481035632855276420051628323",
"189000248311781891643231794744737334456"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1534f6f69393aac773465d80d31801b554352627",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-56698-d5be9a56"
}
]