CVE-2024-26997
published 2024-05-01CVE-2024-26997: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Fixed variable dereference issue in DDMA completion flow.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.90-1 (bookworm) | linux 6.1.90-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 32d3f2f108ebcaf9bd9fc06095c776cb73add034 < 8aa5c28ac65cb5e7f1b9c0c3238c00b661dd2b8c | 8aa5c28ac65cb5e7f1b9c0c3238c00b661dd2b8c |
| linux | linux | >= 4.19.312 < 4.19.313 | 4.19.313 |
| linux | linux | >= 5.10.215 < 5.10.216 | 5.10.216 |
| linux | linux | >= 5.15.154 < 5.15.157 | 5.15.157 |
| linux | linux | >= 5.4.274 < 5.4.275 | 5.4.275 |
| linux | linux | >= 6.1.84 < 6.1.88 | 6.1.88 |
| linux | linux | >= 6.6.24 < 6.6.29 | 6.6.29 |
| linux | linux | >= 6.7.12 < 6.8 | 6.8 |
| linux | linux | >= 6.8.3 < 6.8.8 | 6.8.8 |
| linux | linux | >= 693bbbccd9c774adacaf03ae9fcbb33b66b1ffc4 < 75bf5e78b2a27cb1bca6fa826e3ab685015165e1 | 75bf5e78b2a27cb1bca6fa826e3ab685015165e1 |
| linux | linux | >= 8b7c57ab6f6bc6bfee87e929cab6e6dac351606b < 55656b2afd5f1efcec4245f3e7e814c2a9ef53f6 | 55656b2afd5f1efcec4245f3e7e814c2a9ef53f6 |
| linux | linux | >= 8d310e5d702c903a7ac95fb5dd248f046b39db00 < 8a139fa44870e84ac228b7b76423a49610e5ba9a | 8a139fa44870e84ac228b7b76423a49610e5ba9a |
| linux | linux | >= b258e42688501cadb1a6dd658d6f015df9f32d8f < eed04fa96c48790c1cce73c8a248e9d460b088f8 | eed04fa96c48790c1cce73c8a248e9d460b088f8 |
| linux | linux | >= bc48eb1b53ce977d17d51caa574bd81064a117a2 < 9de10b59d16880a0a3ae2876c142fe54ce45d816 | 9de10b59d16880a0a3ae2876c142fe54ce45d816 |
| linux | linux | >= db4fa0c8e811676a7bfe8363a01e70ee601e75f7 < 26fde0ea40dda1b08fad3bc0a43f122f6dd8bddf | 26fde0ea40dda1b08fad3bc0a43f122f6dd8bddf |
| linux | linux | >= dca1dc1e99e09e7b8eaccb55d6aecb87d9cb8ecd < 257d313e37d66c3bcc87197fb5b8549129c45dfe | 257d313e37d66c3bcc87197fb5b8549129c45dfe |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.216-1 | 5.10.216-1 |
| linux | linux_kernel | >= 0 < 6.1.90-1 | 6.1.90-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.8MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-26
CVE-2024-35929 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-23·CVSS 4.6
CVE-2024-35967 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framewo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-16·CVSS 4.6
CVE-2024-35946 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framewo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 4.6
CVE-2024-35977 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framewo
Red Hat
kernel: usb: dwc2: host: Fix dereference issue in DDMA completion flow.
vendor_redhat·2024-05-01·CVSS 5.5
CVE-2024-26997 [MEDIUM] kernel: usb: dwc2: host: Fix dereference issue in DDMA completion flow.
kernel: usb: dwc2: host: Fix dereference issue in DDMA completion flow.
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Fixed variable dereference issue in DDMA completion flow.
A vulnerability as found in the USB dwc2 host driver in the Linux kernel, involving a dereference issue in the Descriptor-Based DMA (DDMA) completion flow. This issue could lead to undefined behavior or system instability.
Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criter
Debian
CVE-2024-26997: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: ...
vendor_debian·2024·CVSS 5.5
CVE-2024-26997 [MEDIUM] CVE-2024-26997: linux - In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: ...
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.
Scope: local
bookworm: resolved (fixed in 6.1.90-1)
bullseye: resolved (fixed in 5.10.216-1)
forky: resolved (fixed in 6.8.9-1)
sid: resolved (fixed in 6.8.9-1)
trixie: resolved (fixed in 6.8.9-1)
OSV
linux-oracle vulnerabilities
osv·2024-07-26
linux-oracle vulnerabilities
linux-oracle vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- Cryptographic API;
- Buffer Sharing and Synchronization framew
OSV
linux-aws vulnerabilities
osv·2024-07-23·CVSS 6.8
CVE-2024-24857 [MEDIUM] linux-aws vulnerabilities
linux-aws vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- Cryptographic AP
OSV
linux-gke, linux-nvidia vulnerabilities
osv·2024-07-16·CVSS 6.8
CVE-2024-24857 [MEDIUM] linux-gke, linux-nvidia vulnerabilities
linux-gke, linux-nvidia vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- Cr
OSV
linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities
osv·2024-07-11·CVSS 6.8
CVE-2024-24857 [MEDIUM] linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities
linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
-
GHSA
GHSA-mfqx-8929-rf3c: In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: host: Fix dereference issue in DDMA completion flow
ghsa_unreviewed·2024-05-01
CVE-2024-26997 [MEDIUM] CWE-476 GHSA-mfqx-8929-rf3c: In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: host: Fix dereference issue in DDMA completion flow
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Fixed variable dereference issue in DDMA completion flow.
OSV
CVE-2024-26997: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow
osv·2024-05-01·CVSS 5.5
CVE-2024-26997 [MEDIUM] CVE-2024-26997: In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/257d313e37d66c3bcc87197fb5b8549129c45dfehttps://git.kernel.org/stable/c/26fde0ea40dda1b08fad3bc0a43f122f6dd8bddfhttps://git.kernel.org/stable/c/55656b2afd5f1efcec4245f3e7e814c2a9ef53f6https://git.kernel.org/stable/c/75bf5e78b2a27cb1bca6fa826e3ab685015165e1https://git.kernel.org/stable/c/8a139fa44870e84ac228b7b76423a49610e5ba9ahttps://git.kernel.org/stable/c/8aa5c28ac65cb5e7f1b9c0c3238c00b661dd2b8chttps://git.kernel.org/stable/c/9de10b59d16880a0a3ae2876c142fe54ce45d816https://git.kernel.org/stable/c/eed04fa96c48790c1cce73c8a248e9d460b088f8https://git.kernel.org/stable/c/257d313e37d66c3bcc87197fb5b8549129c45dfehttps://git.kernel.org/stable/c/26fde0ea40dda1b08fad3bc0a43f122f6dd8bddfhttps://git.kernel.org/stable/c/55656b2afd5f1efcec4245f3e7e814c2a9ef53f6https://git.kernel.org/stable/c/75bf5e78b2a27cb1bca6fa826e3ab685015165e1https://git.kernel.org/stable/c/8a139fa44870e84ac228b7b76423a49610e5ba9ahttps://git.kernel.org/stable/c/8aa5c28ac65cb5e7f1b9c0c3238c00b661dd2b8chttps://git.kernel.org/stable/c/9de10b59d16880a0a3ae2876c142fe54ce45d816https://git.kernel.org/stable/c/eed04fa96c48790c1cce73c8a248e9d460b088f8https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlhttps://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
2024-05-01
Published