CVE-2024-26600: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
In the Linux kernel, the following vulnerability has been resolved:
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
If the external phy working together with phy-omap-usb2 does not implement sendsrp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example:
configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musbgadgetwakeup+0x1d4/0x254 [musbhdrc] ... musbgadgetwakeup [musbhdrc] from usbgadgetwakeup+0x1c/0x3c [udccore] usbgadgetwakeup [udccore] from ethstartxmit+0x3b0/0x3d4 [uether] ethstartxmit [uether] from devhardstartxmit+0x94/0x24c devhardstartxmit from schdirectxmit+0x104/0x2e4 schdirectxmit from devqueuexmit+0x334/0xd88 devqueuexmit from arpsolicit+0xf0/0x268 arpsolicit from neighprobe+0x54/0x7c neighprobe from neigheventsend+0x22c/0x47c neigheventsend from neighresolveoutput+0x14c/0x1c0 neighresolveoutput from ipfinishoutput2+0x1c8/0x628 ipfinishoutput2 from ipsendskb+0x40/0xd8 ipsendskb from udpsendskb+0x124/0x340 udpsendskb from udpsendmsg+0x780/0x984 udpsendmsg from syssendto+0xd8/0x158 syssendto from retfastsyscall+0x0/0x58
Let's fix the issue by checking for sendsrp() and setvbus() before calling them. For USB peripheral only cases these both could be NULL.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
The Linux kernel CVE team has assigned CVE-2024-26600 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024022405-CVE-2024-26600-44a2@gregkh/T/#u
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference for SRP. A local attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26600?
CVE-2024-26600 is classified as a high severity vulnerability due to the potential for a NULL pointer dereference.
How do I fix CVE-2024-26600?
To fix CVE-2024-26600, update your Linux kernel to version 6.8 or later.
What versions of the Linux kernel are affected by CVE-2024-26600?
CVE-2024-26600 affects Linux kernel versions from 3.7.0 up to and including 6.7.5.
What impact does CVE-2024-26600 have on systems?
CVE-2024-26600 can lead to system crashes or unexpected behavior by causing a NULL pointer dereference.
Is there a specific package recommendation for CVE-2024-26600?
Yes, users should upgrade the 'kernel' package on Red Hat-based systems or the 'linux' package on Debian-based systems to resolve CVE-2024-26600.