In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Check endpoint is valid before dereferencing it

When the host controller is not responding, all URBs queued to all
endpoints need to be killed. This can cause a kernel panic if we
dereference an invalid endpoint.

Fix this by using xhci_get_virt_ep() helper to find the endpoint and
checking if the endpoint is valid before dereferencing it.

[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead
[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8

[233311.853964] pc : xhci_hc_died+0x10c/0x270
[233311.853971] lr : xhci_hc_died+0x1ac/0x270

[233311.854077] Call trace:
[233311.854085] xhci_hc_died+0x10c/0x270
[233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4
[233311.854105] call_timer_fn+0x50/0x2d4
[233311.854112] expire_timers+0xac/0x2e4
[233311.854118] run_timer_softirq+0x300/0xabc
[233311.854127] __do_softirq+0x148/0x528
[233311.854135] irq_exit+0x194/0x1a8
[233311.854143] __handle_domain_irq+0x164/0x1d0
[233311.854149] gic_handle_irq.22273+0x10c/0x188
[233311.854156] el1_irq+0xfc/0x1a8
[233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm]
[233311.854185] cpuidle_enter_state+0x1f0/0x764
[233311.854194] do_idle+0x594/0x6ac
[233311.854201] cpu_startup_entry+0x7c/0x80
[233311.854209] secondary_start_kernel+0x170/0x198

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00007.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
50e8725e7c429701e530439013f9681e1fa36b5d affected
< 375be2dd61a072f7b1cac9b17eea59e07b58db3a
50e8725e7c429701e530439013f9681e1fa36b5d affected
< 2d2820d5f375563690c96e60676855205abfb7f5
50e8725e7c429701e530439013f9681e1fa36b5d affected
< 9891e5c73cab3fd9ed532dc50e9799e55e974766
50e8725e7c429701e530439013f9681e1fa36b5d affected
< 66fc1600855c05c4ba4e997184c91cf298e0405c
50e8725e7c429701e530439013f9681e1fa36b5d affected
< f39c813af0b64f44af94e435c07bfa1ddc2575f5
50e8725e7c429701e530439013f9681e1fa36b5d affected
< 08864dc14a6803f0377ca77b9740b26db30c020f
50e8725e7c429701e530439013f9681e1fa36b5d affected
< e8fb5bc76eb86437ab87002d4a36d6da02165654
Linux Linux affected
Version Status Constraints
3.15 affected
—
0 unaffected
< 3.15
4.14.304 unaffected
≤ 4.14.*
4.19.271 unaffected
≤ 4.19.*
5.4.230 unaffected
≤ 5.4.*
5.10.165 unaffected
≤ 5.10.*
5.15.90 unaffected
≤ 5.15.*
6.1.8 unaffected
≤ 6.1.*
6.2 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/08864dc14a6803f0377ca77b9740b26db30c020f cve-icon cve-icon
https://git.kernel.org/stable/c/2d2820d5f375563690c96e60676855205abfb7f5 cve-icon cve-icon
https://git.kernel.org/stable/c/375be2dd61a072f7b1cac9b17eea59e07b58db3a cve-icon cve-icon
https://git.kernel.org/stable/c/66fc1600855c05c4ba4e997184c91cf298e0405c cve-icon cve-icon
https://git.kernel.org/stable/c/9891e5c73cab3fd9ed532dc50e9799e55e974766 cve-icon cve-icon
https://git.kernel.org/stable/c/e8fb5bc76eb86437ab87002d4a36d6da02165654 cve-icon cve-icon
https://git.kernel.org/stable/c/f39c813af0b64f44af94e435c07bfa1ddc2575f5 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024082113-CVE-2023-52901-c9fb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-52901 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-52901 cve-icon
History

Fri, 13 Sep 2024 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-476
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Aug 2024 02:15:00 +0000

Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Wed, 21 Aug 2024 21:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Aug 2024 06:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check endpoint is valid before dereferencing it When the host controller is not responding, all URBs queued to all endpoints need to be killed. This can cause a kernel panic if we dereference an invalid endpoint. Fix this by using xhci_get_virt_ep() helper to find the endpoint and checking if the endpoint is valid before dereferencing it. [233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead [233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 [233311.853964] pc : xhci_hc_died+0x10c/0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270 [233311.854077] Call trace: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 [233311.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300/0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.854209] secondary_start_kernel+0x170/0x198
Title usb: xhci: Check endpoint is valid before dereferencing it
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:45:40.190Z

Reserved: 2024-08-21T06:07:11.014Z

Link: CVE-2023-52901

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:18.826Z

cve-icon NVD

Status : Analyzed

Published: 2024-08-21T07:15:06.363

Modified: 2024-09-13T13:37:17.943

Link: CVE-2023-52901

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-08-21T00:00:00Z

Links: CVE-2023-52901 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses