CVE-2024-56687

Summary

CVE-2024-56687 is a vulnerability in the Linux kernel's USB subsystem. It allows for a hardware lockup in the first Rx endpoint when a request's callback is invoked from usb_ep_queue(). This can occur when IRQs are enabled during the callback, causing a deadlock situation. The USB Ethernet gadget is particularly susceptible to this issue due to its rx_complete() callback disabling and re-enabling IRQs. Potential resolutions include ensuring callbacks never enable IRQs, disabling MUSB interrupts before calling the callback and re-enabling them afterwards, modifying the interrupt handler to clear the RXPKTRDY flag if the request queue is empty, or flushing the Rx FIFO instead of calling rxstate() in musb_ep_restart().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.