CVE-2021-46986

Summary

CVE-2021-46986 is a vulnerability affecting the Linux kernel's USB subsystem. Specifically, the dwc3 gadget driver contains a flaw where the gadget structure is freed before its endpoints, leading to dangling pointers. The issue arises due to the dep->endpoint.ep_list members being chained off the gadget's ep_list. As a result, when dwc->gadget is freed, the first and last dwc3_ep in the list have dangling prev and next pointers, respectively. This can cause a use-after-free error when list_del() is called in dwc3_gadget_free_endpoints(). The vulnerability was detected while enabling KASAN and unbinding the driver. A possible solution is to remove the gadget->ep_list from the dwc3_ep chain by performing a list_del() of the gadget->ep_list. Alternatively, the issue can be resolved by splitting the usb_del_gadget_udc() call into its separate "del" and "put" components, allowing dwc3_gadget_free_endpoints() to be called before the gadget is freed with usb_put_gadget().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.