Debian: CVE-2024-42085: linux, linux-6.1 -- security update

Debian: CVE-2024-42085: linux, linux-6.1 -- security update

Severity

5

CVSS

(AV:L/AC:L/Au:S/C:N/I:N/A:C)

Published

07/29/2024

Created

08/08/2024

Added

08/07/2024

Modified

01/30/2025

Description

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system to enter suspend status with below command: echo mem > /sys/power/state There will be a deadlock issue occurring. Detailed invoking path as below: dwc3_suspend_common() spin_lock_irqsave(&dwc->lock, flags);<-- 1st dwc3_gadget_suspend(dwc); dwc3_gadget_soft_disconnect(dwc); spin_lock_irqsave(&dwc->lock, flags);<-- 2nd This issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that removes the code of checking whether dwc->gadget_driver is NULL or not. It causes the following code is executed and deadlock occurs when trying to get the spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3: Remove DWC3 locking during gadget suspend/resume") that forgot to remove the lock of otg mode. So, remove the redundant lock of otg mode during gadget suspend/resume.

Solution(s)

• debian-upgrade-linux
• debian-upgrade-linux-6-1

References

• https://attackerkb.com/topics/cve-2024-42085
• CVE - 2024-42085
• DLA-4008-1