CVE-2023-52855
published 2024-05-21CVE-2023-52855: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without
holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue():
spin_lock_irqsave(&hsotg->lock, flags);
...
if (!urb->hcpriv) {
dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n");
goto out;
}
rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv
...
out:
spin_unlock_irqrestore(&hsotg->lock, flags);
When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are
concurrently executed, the NULL check of "urb->hcpriv" can be executed
before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used
in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL
pointer dereference.
This possible bug is found by an experimental static analysis tool
developed by myself. This tool analyzes the locking APIs to extract
function pairs that can be concurrently executed, and then analyzes the
instructions in the paired functions to identify possible concurrency
bugs including data races and atomicity violations. The above possible
bug is reported, when my tool analyzes the source code of Linux 6.5.
To fix this possible bug, "urb->hcpriv = NULL" should be executed with
holding the lock "hsotg->lock". After using this patch, my tool never
reports the possible bug, with the kernelconfiguration allyesconfig for
x86_64. Because I have no associated hardware, I cannot test the patch
in runtime testing, and just verify it according to the code logic.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < 14c9ec34e8118fbffd7f5431814d767726323e72 | 14c9ec34e8118fbffd7f5431814d767726323e72 |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < fed492aa6493a91a77ebd51da6fb939c98d94a0d | fed492aa6493a91a77ebd51da6fb939c98d94a0d |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < 64c47749fc7507ed732e155c958253968c1d275e | 64c47749fc7507ed732e155c958253968c1d275e |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < bdb3dd4096302d6b87441fdc528439f171b04be6 | bdb3dd4096302d6b87441fdc528439f171b04be6 |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < fcaafb574fc88a52dce817f039f7ff2f9da38001 | fcaafb574fc88a52dce817f039f7ff2f9da38001 |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < 6b21a22728852d020a6658d39cd7bb7e14b07790 | 6b21a22728852d020a6658d39cd7bb7e14b07790 |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < 3e851a77a13ce944d703721793f49ee82622986d | 3e851a77a13ce944d703721793f49ee82622986d |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < a7bee9598afb38004841a41dd8fe68c1faff4e90 | a7bee9598afb38004841a41dd8fe68c1faff4e90 |
| linux | linux | >= 33ad261aa62be02f0cedeb4d5735cc726de84a3f < ef307bc6ef04e8c1ea843231db58e3afaafa9fa6 | ef307bc6ef04e8c1ea843231db58e3afaafa9fa6 |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 4.15 < 4.19.299 | 4.19.299 |
| linux | linux_kernel | >= 4.2 < 4.14.330 | 4.14.330 |
| linux | linux_kernel | >= 4.20 < 5.4.261 | 5.4.261 |
| linux | linux_kernel | >= 5.11 < 5.15.139 | 5.15.139 |
| linux | linux_kernel | >= 5.16 < 6.1.63 | 6.1.63 |
| linux | linux_kernel | >= 5.5 < 5.10.201 | 5.10.201 |
| linux | linux_kernel | >= 6.2 < 6.5.12 | 6.5.12 |
| linux | linux_kernel | >= 6.6 < 6.6.2 | 6.6.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2023-52855 [MEDIUM] CWE-413 kernel: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
kernel: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without
holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue():
spin_lock_irqsave(&hsotg->lock, flags);
...
if (!urb->hcpriv) {
dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n");
goto out;
}
rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv
...
out:
spin_unlock_irqrestore(&hsotg->lock, flags);
When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are
concurrently executed, the NULL check of "urb->hcpriv" can be executed
before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it
Debian
CVE-2023-52855: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: ...
vendor_debian·2023·CVSS 5.5
CVE-2023-52855 [MEDIUM] CVE-2023-52855: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: ...
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue(): spin_lock_irqsave(&hsotg->lock, flags); ... if (!urb->hcpriv) { dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n"); goto out; } rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv ... out: spin_unlock_irqrestore(&hsotg->lock, flags); When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are concurrently executed, the NULL check of "urb->hcpriv" can be executed before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL poi
GHSA
GHSA-5c84-c56q-jq6c: In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In
ghsa_unreviewed·2024-05-21
CVE-2023-52855 [MEDIUM] CWE-476 GHSA-5c84-c56q-jq6c: In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without
holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue():
spin_lock_irqsave(&hsotg->lock, flags);
...
if (!urb->hcpriv) {
dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n");
goto out;
}
rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv
...
out:
spin_unlock_irqrestore(&hsotg->lock, flags);
When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are
concurrently executed, the NULL check of "urb->hcpriv" can be executed
before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used
in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL
OSV
CVE-2023-52855: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In _
osv·2024-05-21·CVSS 5.5
CVE-2023-52855 [MEDIUM] CVE-2023-52855: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In _
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue(): spin_lock_irqsave(&hsotg->lock, flags); ... if (!urb->hcpriv) { dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n"); goto out; } rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv ... out: spin_unlock_irqrestore(&hsotg->lock, flags); When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are concurrently executed, the NULL check of "urb->hcpriv" can be executed before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL poi
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/14c9ec34e8118fbffd7f5431814d767726323e72https://git.kernel.org/stable/c/3e851a77a13ce944d703721793f49ee82622986dhttps://git.kernel.org/stable/c/64c47749fc7507ed732e155c958253968c1d275ehttps://git.kernel.org/stable/c/6b21a22728852d020a6658d39cd7bb7e14b07790https://git.kernel.org/stable/c/a7bee9598afb38004841a41dd8fe68c1faff4e90https://git.kernel.org/stable/c/bdb3dd4096302d6b87441fdc528439f171b04be6https://git.kernel.org/stable/c/ef307bc6ef04e8c1ea843231db58e3afaafa9fa6https://git.kernel.org/stable/c/fcaafb574fc88a52dce817f039f7ff2f9da38001https://git.kernel.org/stable/c/fed492aa6493a91a77ebd51da6fb939c98d94a0dhttps://git.kernel.org/stable/c/14c9ec34e8118fbffd7f5431814d767726323e72https://git.kernel.org/stable/c/3e851a77a13ce944d703721793f49ee82622986dhttps://git.kernel.org/stable/c/64c47749fc7507ed732e155c958253968c1d275ehttps://git.kernel.org/stable/c/6b21a22728852d020a6658d39cd7bb7e14b07790https://git.kernel.org/stable/c/a7bee9598afb38004841a41dd8fe68c1faff4e90https://git.kernel.org/stable/c/bdb3dd4096302d6b87441fdc528439f171b04be6https://git.kernel.org/stable/c/ef307bc6ef04e8c1ea843231db58e3afaafa9fa6https://git.kernel.org/stable/c/fcaafb574fc88a52dce817f039f7ff2f9da38001https://git.kernel.org/stable/c/fed492aa6493a91a77ebd51da6fb939c98d94a0d
2024-05-21
Published