CVE-2024-50100

Summary

CVE-2024-50100 is a vulnerability affecting the Linux kernel's USB gadget dummy-hcd driver. The syzbot fuzzer has exposed a problem where the driver's use of hrtimers instead of regular timers resulted in a "task hung" issue. This was due to a discrepancy between the timer_pending() and hrtimer_active() APIs, which led to the driver failing to restart the hrtimer, resulting in a hung usb_kill_urb() routine. The vulnerability has been addressed by the addition of a new "timer_pending" flag, allowing the driver to keep track of the hrtimer's state.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.