CVE-2024-36977

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Wait unconditionally after issuing EndXfer command

Currently all controller IP/revisions except DWC3_usb3 >= 310a

wait 1ms unconditionally for ENDXFER completion when IOC is not

set. This is because DWC_usb3 controller revisions >= 3.10a

supports GUCTL2[14: Rst_actbitlater] bit which allows polling

CMDACT bit to know whether ENDXFER command is completed.

Consider a case where an IN request was queued, and parallelly

soft_disconnect was called (due to ffs_epfile_release). This

eventually calls stop_active_transfer with IOC cleared, hence

send_gadget_ep_cmd() skips waiting for CMDACT cleared during

EndXfer. For DWC3 controllers with revisions >= 310a, we don't

forcefully wait for 1ms either, and we proceed by unmapping the

requests. If ENDXFER didn't complete by this time, it leads to

SMMU faults since the controller would still be accessing those

requests.

Fix this by ensuring ENDXFER completion by adding

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References