CVE-2024-56698

Summary

CVE-2024-56698 is a vulnerability affecting the Linux kernel's USB gadget driver dwc3. This issue arises from a failure to accurately track the number of SCSI Generic Command List (SG) entries for a request. Specifically, if a partially completed request is handled, the dwc3_request->num_queued_sgs count is not updated correctly. Consequently, a null pointer dereference may occur when accessing a non-existent SG entry. This vulnerability has been addressed by properly verifying the number of remaining request SG entries before preparing and queuing them.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.