cve-2023-52901
Vulnerability from cvelistv5
Published
2024-08-21 06:10
Modified
2024-11-04 14:54
Severity ?
EPSS score ?
Summary
usb: xhci: Check endpoint is valid before dereferencing it
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-52901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:03:27.437210Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T17:33:14.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "375be2dd61a0",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
},
{
"lessThan": "2d2820d5f375",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
},
{
"lessThan": "9891e5c73cab",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
},
{
"lessThan": "66fc1600855c",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
},
{
"lessThan": "f39c813af0b6",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
},
{
"lessThan": "08864dc14a68",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
},
{
"lessThan": "e8fb5bc76eb8",
"status": "affected",
"version": "50e8725e7c42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.304",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Check endpoint is valid before dereferencing it\n\nWhen the host controller is not responding, all URBs queued to all\nendpoints need to be killed. This can cause a kernel panic if we\ndereference an invalid endpoint.\n\nFix this by using xhci_get_virt_ep() helper to find the endpoint and\nchecking if the endpoint is valid before dereferencing it.\n\n[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead\n[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8\n\n[233311.853964] pc : xhci_hc_died+0x10c/0x270\n[233311.853971] lr : xhci_hc_died+0x1ac/0x270\n\n[233311.854077] Call trace:\n[233311.854085] xhci_hc_died+0x10c/0x270\n[233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4\n[233311.854105] call_timer_fn+0x50/0x2d4\n[233311.854112] expire_timers+0xac/0x2e4\n[233311.854118] run_timer_softirq+0x300/0xabc\n[233311.854127] __do_softirq+0x148/0x528\n[233311.854135] irq_exit+0x194/0x1a8\n[233311.854143] __handle_domain_irq+0x164/0x1d0\n[233311.854149] gic_handle_irq.22273+0x10c/0x188\n[233311.854156] el1_irq+0xfc/0x1a8\n[233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm]\n[233311.854185] cpuidle_enter_state+0x1f0/0x764\n[233311.854194] do_idle+0x594/0x6ac\n[233311.854201] cpu_startup_entry+0x7c/0x80\n[233311.854209] secondary_start_kernel+0x170/0x198"
}
],
"providerMetadata": {
"dateUpdated": "2024-11-04T14:54:51.217Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/375be2dd61a072f7b1cac9b17eea59e07b58db3a"
},
{
"url": "https://git.kernel.org/stable/c/2d2820d5f375563690c96e60676855205abfb7f5"
},
{
"url": "https://git.kernel.org/stable/c/9891e5c73cab3fd9ed532dc50e9799e55e974766"
},
{
"url": "https://git.kernel.org/stable/c/66fc1600855c05c4ba4e997184c91cf298e0405c"
},
{
"url": "https://git.kernel.org/stable/c/f39c813af0b64f44af94e435c07bfa1ddc2575f5"
},
{
"url": "https://git.kernel.org/stable/c/08864dc14a6803f0377ca77b9740b26db30c020f"
},
{
"url": "https://git.kernel.org/stable/c/e8fb5bc76eb86437ab87002d4a36d6da02165654"
}
],
"title": "usb: xhci: Check endpoint is valid before dereferencing it",
"x_generator": {
"engine": "bippy-9e1c9544281a"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-52901",
"datePublished": "2024-08-21T06:10:41.640Z",
"dateReserved": "2024-08-21T06:07:11.014Z",
"dateUpdated": "2024-11-04T14:54:51.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-52901\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:06.363\",\"lastModified\":\"2024-09-13T13:37:17.943\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: xhci: Check endpoint is valid before dereferencing it\\n\\nWhen the host controller is not responding, all URBs queued to all\\nendpoints need to be killed. This can cause a kernel panic if we\\ndereference an invalid endpoint.\\n\\nFix this by using xhci_get_virt_ep() helper to find the endpoint and\\nchecking if the endpoint is valid before dereferencing it.\\n\\n[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead\\n[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8\\n\\n[233311.853964] pc : xhci_hc_died+0x10c/0x270\\n[233311.853971] lr : xhci_hc_died+0x1ac/0x270\\n\\n[233311.854077] Call trace:\\n[233311.854085] xhci_hc_died+0x10c/0x270\\n[233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4\\n[233311.854105] call_timer_fn+0x50/0x2d4\\n[233311.854112] expire_timers+0xac/0x2e4\\n[233311.854118] run_timer_softirq+0x300/0xabc\\n[233311.854127] __do_softirq+0x148/0x528\\n[233311.854135] irq_exit+0x194/0x1a8\\n[233311.854143] __handle_domain_irq+0x164/0x1d0\\n[233311.854149] gic_handle_irq.22273+0x10c/0x188\\n[233311.854156] el1_irq+0xfc/0x1a8\\n[233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm]\\n[233311.854185] cpuidle_enter_state+0x1f0/0x764\\n[233311.854194] do_idle+0x594/0x6ac\\n[233311.854201] cpu_startup_entry+0x7c/0x80\\n[233311.854209] secondary_start_kernel+0x170/0x198\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: usb: xhci: verifique que el endpoint sea v\u00e1lido antes de desreferenciarlo. Cuando el controlador de host no responde, se deben eliminar todas las URB en cola para todos los endpoints. Esto puede provocar un p\u00e1nico en el kernel si eliminamos la referencia a un endpoint no v\u00e1lido. Solucione este problema utilizando el asistente xhci_get_virt_ep() para encontrar el endpoint y comprobar si es v\u00e1lido antes de desreferenciarlo. [233311.853271] xhci-hcd xhci-hcd.1.auto: El controlador de host xHCI no responde, se supone muerto [233311.853393] No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 00000000000000e8 [233311.853964] pc: xhci_hc_died+0x10c/ 0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270 [233311.854077] Rastreo de llamadas: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 11.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300 /0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c /0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.8542 09] kernel_inicio_secundario+0x170/0x198\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.15\",\"versionEndExcluding\":\"4.14.304\",\"matchCriteriaId\":\"A0519E43-4E92-4BCE-92E7-956733784203\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.271\",\"matchCriteriaId\":\"D86DA289-B5BC-4629-BD56-AB453D481393\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.230\",\"matchCriteriaId\":\"9DB7398D-9781-49C5-B2AE-1969B694B614\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.165\",\"matchCriteriaId\":\"C6002D5B-9B6A-4788-B943-E3EE01E01303\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.90\",\"matchCriteriaId\":\"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.8\",\"matchCriteriaId\":\"A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08864dc14a6803f0377ca77b9740b26db30c020f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d2820d5f375563690c96e60676855205abfb7f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/375be2dd61a072f7b1cac9b17eea59e07b58db3a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66fc1600855c05c4ba4e997184c91cf298e0405c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9891e5c73cab3fd9ed532dc50e9799e55e974766\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8fb5bc76eb86437ab87002d4a36d6da02165654\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f39c813af0b64f44af94e435c07bfa1ddc2575f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.