CVE-2023-52855

What it actually does

Race condition in Linux kernel DWC2 USB HCD allowing concurrent _dwc2_hcd_urb_enqueue and _dwc2_hcd_urb_dequeue to dereference a NULL urb->hcpriv pointer because the assignment to NULL occurs without holding hsotg->lock.

Why it matters to the business

Systems using the DWC2 USB controller may experience kernel crashes or panics under concurrent USB URB operations, resulting in denial of service and potential loss of USB device functionality until reboot.

How an attack unfolds

An attacker with local access triggers simultaneous URB enqueue and dequeue calls on a DWC2-controlled USB device; the NULL assignment in enqueue executes after the dequeue NULL check but before the actual dereference in dwc2_hcd_urb_dequeue, causing a NULL pointer dereference.

How to fix it

Apply the upstream fix in commit 14c9ec34e8118fbffd7f5431814d767726323e72 which moves the urb->hcpriv = NULL assignment inside the hsotg->lock critical section; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the _dwc2_hcd_urb_enqueue source to confirm urb->hcpriv = NULL is now protected by spin_lock_irqsave(&hsotg->lock); re-run static analysis tools on the patched kernel tree.

Typical attack path

1. Obtain local code execution or user privileges on a Linux system with DWC2 USB hardware
2. Issue concurrent URB enqueue and dequeue operations against the DWC2 controller
3. Trigger the unprotected assignment of urb->hcpriv = NULL to bypass the NULL check in dequeue
4. Cause kernel NULL pointer dereference leading to panic or oops

How to detect it

Search kernel logs and crash dumps for oops/panic messages referencing dwc2_hcd_urb_dequeue and NULL pointer dereference; correlate with USB device attach/detach events around the same timestamp.

What your security team should do

• Prioritize patching all affected Linux kernels to the commit containing 14c9ec34e8118fbffd7f5431814d767726323e72
• Reboot systems after applying the kernel update to activate the fix
• Limit untrusted local user access on systems exposing DWC2 USB controllers until patched