CVE-2024-45006

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration

re-enumerating full-speed devices after a failed address device command

can trigger a NULL pointer dereference.

Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size

value during enumeration. Usb core calls usb_ep0_reinit() in this case,

which ends up calling xhci_configure_endpoint().

On Panther point xHC the xhci_configure_endpoint() function will

additionally check and reserve bandwidth in software. Other hosts do

this in hardware

If xHC address device command fails then a new xhci_virt_device structure

is allocated as part of re-enabling the slot, but the bandwidth table

pointers are not set up properly here.

This triggers the NULL pointer dereference the next time usb_ep0_reinit()

is called and xhci_configure_endpoint() tries to check and reserve

bandwidth

[46710.713538] usb 3-1: new full-speed USB device number 5 usi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References