OpenCVE

In the Linux kernel, the following vulnerability has been resolved: usb: core: Prevent null pointer dereference in update_port_device_state Currently, the function update_port_device_state gets the usb_hub from udev->parent by calling usb_hub_to_struct_hub. However, in case the actconfig or the maxchild is 0, the usb_hub would be NULL and upon further accessing to get port_dev would result in null pointer dereference. Fix this by introducing an if check after the usb_hub is populated.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/12783c0b9e2c7915a50d5ec829630ff2da50472c
https://git.kernel.org/stable/c/465b545d1d7ef282192ddd4439b08279bdb13f6f
https://git.kernel.org/stable/c/ed85777c640cf9e6920bb1b60ed8cd48e1f4d873
https://lore.kernel.org/linux-cve-announce/2024040343-CVE-2024-26716-74a8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26716
https://www.cve.org/CVERecord?id=CVE-2024-26716

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-03T14:55:17.305Z

Updated: 2024-11-05T09:14:25.452Z

Reserved: 2024-02-19T14:20:24.160Z

Link: CVE-2024-26716

Vulnrichment

Updated: 2024-08-02T00:14:12.989Z

NVD

Status : Awaiting Analysis

Published: 2024-04-03T15:15:53.800

Modified: 2024-11-21T09:02:54.497

Link: CVE-2024-26716

Redhat

Severity : Low

Publid Date: 2024-04-03T00:00:00Z

Links: CVE-2024-26716 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26716", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.160Z", "datePublished": "2024-04-03T14:55:17.305Z", "dateUpdated": "2024-11-05T09:14:25.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:14:25.452Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: Prevent null pointer dereference in update_port_device_state\n\nCurrently, the function update_port_device_state gets the usb_hub from\nudev->parent by calling usb_hub_to_struct_hub.\nHowever, in case the actconfig or the maxchild is 0, the usb_hub would\nbe NULL and upon further accessing to get port_dev would result in null\npointer dereference.\n\nFix this by introducing an if check after the usb_hub is populated."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/core/hub.c"], "versions": [{"version": "83cb2604f641", "lessThan": "ed85777c640c", "status": "affected", "versionType": "git"}, {"version": "83cb2604f641", "lessThan": "465b545d1d7e", "status": "affected", "versionType": "git"}, {"version": "83cb2604f641", "lessThan": "12783c0b9e2c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/core/hub.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/ed85777c640cf9e6920bb1b60ed8cd48e1f4d873"}, {"url": "https://git.kernel.org/stable/c/465b545d1d7ef282192ddd4439b08279bdb13f6f"}, {"url": "https://git.kernel.org/stable/c/12783c0b9e2c7915a50d5ec829630ff2da50472c"}], "title": "usb: core: Prevent null pointer dereference in update_port_device_state", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T19:29:15.448916Z", "id": "CVE-2024-26716", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:29:25.918Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.989Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ed85777c640cf9e6920bb1b60ed8cd48e1f4d873", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/465b545d1d7ef282192ddd4439b08279bdb13f6f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/12783c0b9e2c7915a50d5ec829630ff2da50472c", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ed85777c640cf9e6920bb1b60ed8cd48e1f4d873", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/465b545d1d7ef282192ddd4439b08279bdb13f6f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/12783c0b9e2c7915a50d5ec829630ff2da50472c", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.989Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26716", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T19:29:15.448916Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:29:21.985Z"}}], "cna": {"title": "usb: core: Prevent null pointer dereference in update_port_device_state", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "83cb2604f641", "lessThan": "ed85777c640c", "versionType": "git"}, {"status": "affected", "version": "83cb2604f641", "lessThan": "465b545d1d7e", "versionType": "git"}, {"status": "affected", "version": "83cb2604f641", "lessThan": "12783c0b9e2c", "versionType": "git"}], "programFiles": ["drivers/usb/core/hub.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.18", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/core/hub.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ed85777c640cf9e6920bb1b60ed8cd48e1f4d873"}, {"url": "https://git.kernel.org/stable/c/465b545d1d7ef282192ddd4439b08279bdb13f6f"}, {"url": "https://git.kernel.org/stable/c/12783c0b9e2c7915a50d5ec829630ff2da50472c"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: Prevent null pointer dereference in update_port_device_state\n\nCurrently, the function update_port_device_state gets the usb_hub from\nudev->parent by calling usb_hub_to_struct_hub.\nHowever, in case the actconfig or the maxchild is 0, the usb_hub would\nbe NULL and upon further accessing to get port_dev would result in null\npointer dereference.\n\nFix this by introducing an if check after the usb_hub is populated."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:14:25.452Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26716", "state": "PUBLISHED", "dateUpdated": "2024-11-05T09:14:25.452Z", "dateReserved": "2024-02-19T14:20:24.160Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-03T14:55:17.305Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}