NULL Pointer Dereference in Linux Kernel Affects USB Command Handling

CVE-2024-57981

Summary

A vulnerability in the Linux kernel affects USB command handling, specifically during command abortion procedures. When a command is queued to the final usable TRB of a ring segment and is subsequently aborted, a NULL pointer dereference can occur in the xhci_handle_stopped_cmd_ring() function. This issue arises due to the dequeue pointer being advanced incorrectly, leading to the assumption that a pending command exists when there is none. This flaw can result in system crashes. Recent tests with a USB MCU have confirmed that the issue can be reproduced and has been adequately addressed to prevent crashes, enhancing the reliability of USB command execution.

References