CVE-2024-26933

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix deadlock in port disable sysfs attribute

The show and store callback routines for the disable sysfs attribute file in port.c acquire the device lock for the ports parent hub device. This can cause problems if another process has locked the hub to remove it or change its configuration:

Removing the hub or changing its configuration requires the
hub interface to be removed, which requires the port device
to be removed, and device_del() waits until all outstanding
sysfs attribute callbacks for the ports have returned.  The
lock cant be released until then.

But the disable_show() or disable_store() routine cant return
until after it has acquired the lock.

The resulting deadlock can be avoided by calling sysfs_break_active_protection(). This will cause the sysfs core not to wait for the attributes callback routine to return, allowing the removal to proceed. The disadvantage is that after making this call, there is no guarantee that the hub structure wont be deallocated at any moment. To prevent this, we have to acquire a reference to it first by calling hub_get().

Weakness

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Software

Extended Description

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/25.html
• https://cwe.mitre.org/data/definitions/26.html
• https://cwe.mitre.org/data/definitions/27.html

References

• https://git.kernel.org/stable/c/4facc9421117ba9d8148c73771b213887fec77f7
• https://git.kernel.org/stable/c/73d1589b91f2099e5f6534a8497b7c6b527e064e
• https://git.kernel.org/stable/c/9dac54f08198147f5ec0ec52fcf1bc8ac899ac05
• https://git.kernel.org/stable/c/f4d1960764d8a70318b02f15203a1be2b2554ca1
• https://git.kernel.org/stable/c/f51849833705dea5b4f9b0c8de714dd87bd6c95c
• https://git.kernel.org/stable/c/4facc9421117ba9d8148c73771b213887fec77f7
• https://git.kernel.org/stable/c/73d1589b91f2099e5f6534a8497b7c6b527e064e
• https://git.kernel.org/stable/c/9dac54f08198147f5ec0ec52fcf1bc8ac899ac05
• https://git.kernel.org/stable/c/f4d1960764d8a70318b02f15203a1be2b2554ca1
• https://git.kernel.org/stable/c/f51849833705dea5b4f9b0c8de714dd87bd6c95c