CVE-2024-50075 xhci: tegra: fix checked USB2 port number
A null pointer dereference in the Linux kernel Tegra xHCI driver causes a crash when USB virtualization is enabled and specific port checks fail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50075?
CVE-2024-50075 is a high-severity vulnerability in Linux kernel, published on 29 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xhci: tegra: fix checked USB2 port number
If USB virtualizatoin is enabled, USB2 ports are shared between all Virtual Functions. The USB2 port number owned by an USB2 root hub in a Virtual Function may be less than total USB2 phy number supported by the Tegra XUSB controller.
Using total USB2 phy number as port number to check all PORTSC values would cause invalid memory access.
[ 116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f ... [ 117.213640] Call trace: [ 117.216783] tegra_xusb_enter_elpg+0x23c/0x658 [ 117.222021] tegra_xusb_runtime_suspend+0x40/0x68 [ 117.227260] pm_generic_runtime_suspend+0x30/0x50 [ 117.232847] __rpm_callback+0x84/0x3c0 [ 117.237038] rpm_suspend+0x2dc/0x740 [ 117.241229] pm_runtime_work+0xa0/0xb8 [ 117.245769] process_scheduled_works+0x24c/0x478 [ 117.251007] worker_thread+0x23c/0x328 [ 117.255547] kthread+0x104/0x1b0 [ 117.259389] ret_from_fork+0x10/0x20 [ 117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)
Which versions are affected by CVE-2024-50075?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50075?
Apply the vendor's patch.
Is CVE-2024-50075 being exploited?
There is no known exploitation of CVE-2024-50075 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-52058, BELL-CVE-2024-50075, DEBIAN-CVE-2024-50075, GHSA-rjp6-prx7-2cj4, UBUNTU-CVE-2024-50075.