CVE-2024-36894

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete

FFS based applications can utilize the aio_cancel() callback to dequeue

pending USB requests submitted to the UDC. There is a scenario where the

FFS application issues an AIO cancel call, while the UDC is handling a

soft disconnect. For a DWC3 based implementation, the callstack looks

like the following:

DWC3 Gadget FFS Application

dwc3_gadget_soft_disconnect() ...

--> dwc3_stop_active_transfers()

--> dwc3_gadget_giveback(-ESHUTDOWN)

--> ffs_epfile_async_io_complete() ffs_aio_cancel()

--> usb_ep_free_request() --> usb_ep_dequeue()

There is currently no locking implemented between the AIO completion

handler and AIO cancel, so the issue occurs if the completion routine is

running in parallel to an AIO cancel call coming from the FFS application.

As the completion

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References