CVE-2024-26933

Description

In the Linux kernel, the following vulnerability has been resolved:USB: core: Fix deadlock in port disable sysfs attributeThe show and store callback routines for the disable sysfs attributefile in port.c acquire the device lock for the ports parent hubdevice. This can cause problems if another process has locked the hubto remove it or change its configuration:Removing the hub or changing its configuration requires thehub interface to be removed, which requires the port deviceto be removed, and device_del() waits until all outstandingsysfs attribute callbacks for the ports have returned. Thelock cant be released until then.But the disable_show() or disable_store() routine cant returnuntil after it has acquired the lock.The resulting deadlock can be avoided by callingsysfs_break_active_protection(). This will cause the sysfs core notto wait for the attributes callback routine to return, allowing theremoval to proceed. The disadvantage is that after making this call,there is no guarantee that the hub structure wont be deallocated atany moment. To prevent this, we have to acquire a reference to itfirst by calling hub_get().

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234