CVE-2023-54159

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: mtu3: fix kernel panic at qmu transfer done irq handler

When handle qmu transfer irq, it will unlock @mtu->lock before give back

request, if another thread handle disconnect event at the same time, and

try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu

irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before

handling it.

e.g.

qmu done irq on cpu0 thread running on cpu1

qmu_done_tx()

handle gpd [0]

mtu3_requ_complete() mtu3_gadget_ep_disable()

unlock @mtu->lock

give back request lock @mtu->lock

mtu3_ep_disable()

mtu3_gpd_ring_free()

unlock @mtu->lock

lock @mtu->lock

get next gpd [1]

[1]: goto [0] to handle next gpd, and next gpd may be NULL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References