CVE-2024-40904— USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
Affected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9908a32e94de2141463e104c9924279ed3509447< 217d1f44fff560b3995a685a60aa66e55a7f0f56 | affected |
9908a32e94de2141463e104c9924279ed3509447< 05b2cd6d33f700597e6f081b53c668a226a96d28 | affected | ||
9908a32e94de2141463e104c9924279ed3509447< c0747d76eb05542b5d49f67069b64ef5ff732c6c | affected | ||
9908a32e94de2141463e104c9924279ed3509447< 53250b54c92fe087fd4b0c48f85529efe1ebd879 | affected | ||
9908a32e94de2141463e104c9924279ed3509447< 02a4c0499fc3a02e992b4c69a9809912af372d94 | affected | ||
9908a32e94de2141463e104c9924279ed3509447< 72a3fe36cf9f0d030865e571f45a40f9c1e07e8a | affected | ||
9908a32e94de2141463e104c9924279ed3509447< 82075aff7ffccb1e72b0ac8aa349e473624d857c | affected | ||
9908a32e94de2141463e104c9924279ed3509447< 22f00812862564b314784167a89f27b444f82a46 | affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-40904
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driver's immediate resubmission of interrupt URBs with -EPROTO status combined with the dummy-hcd emulation to cause a CPU lockup: cdc_wdm 1-1:1.0: nonzero urb status received: -71 cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625] CPU#0 Utilization every 4s during lockup: #1: 98% system, 0% softirq, 3% hardirq, 0% idle #2: 98% system, 0% softirq, 3% hardirq, 0% idle #3: 98% system, 0% softirq, 3% hardirq, 0% idle #4: 98% system, 0% softirq, 3% hardirq, 0% idle #5: 98% system, 1% softirq, 3% hardirq, 0% idle Modules linked in: irq event stamp: 73096 hardirqs last enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline] hardirqs last enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994 hardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582 softirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588 CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Testing showed that the problem did not occur if the two error messages -- the first two lines above -- were removed; apparently adding material to the kernel log takes a surprisingly large amount of time. In any case, the best approach for preventing these lockups and to avoid spamming the log with thousands of error messages per second is to ratelimit the two dev_err() calls. Therefore we replace them with dev_err_ratelimited().
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 USB:class:cdc-wdm 驱动的interrupt-URB完成回调处理时间过长，并且错误地重新提交中断URB，结合特定的硬件模拟，可能导致 CPU 锁死。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-40904
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-40904
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-07-12 · 122 CVEs total
| CVE-2024-40960 | ipv6: prevent possible NULL dereference in rt6_probe() | |
| CVE-2024-40975 | platform/x86: x86-android-tablets: Unregister devices in reverse order | |
| CVE-2024-40974 | powerpc/pseries: Enforce hcall result buffer validity and size | |
| CVE-2024-40973 | media: mtk-vcodec: potential null pointer deference in SCP | |
| CVE-2024-40972 | ext4: do not create EA inode under buffer lock | |
| CVE-2024-40970 | Avoid hw_desc array overrun in dw-axi-dmac | |
| CVE-2024-40971 | f2fs: remove clear SB_INLINECRYPT flag in default_options | |
| CVE-2024-40969 | f2fs: don't set RO when shutting down f2fs | |
| CVE-2024-40967 | serial: imx: Introduce timeout when waiting on transmitter empty | |
| CVE-2024-40968 | MIPS: Octeon: Add PCIe link status check | |
| CVE-2024-40966 | tty: add the option to have a tty reject a new ldisc | |
| CVE-2024-40965 | i2c: lpi2c: Avoid calling clk_get_rate during transfer | |
| CVE-2024-40964 | ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind() | |
| CVE-2024-40963 | mips: bmips: BCM6358: make sure CBR is correctly set | |
| CVE-2024-40961 | ipv6: prevent possible NULL deref in fib6_nh_init() | |
| CVE-2024-40962 | btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes | |
| CVE-2024-40951 | ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() | |
| CVE-2024-40950 | mm: huge_memory: fix misused mapping_large_folio_support() for anon folios | |
| CVE-2024-40949 | mm: shmem: fix getting incorrect lruvec when replacing a shmem folio | |
| CVE-2024-40952 | ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty() |
Showing top 20 of 122 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
Same vendor: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
V. Comments for CVE-2024-40904
No comments yet