CVE-2024-44960

What it actually does

Null pointer dereference in USB gadget core when maxpacket is accessed before a descriptor has been set for the current speed or endpoint, resulting in kernel panic.

Why it matters to the business

Kernel crashes on systems using USB gadget functionality during development or with malformed descriptors, potentially disrupting device operation and requiring restarts, though impact is limited as no production drivers are known to trigger it.

How an attack unfolds

An attacker with local access supplies a gadget driver or malformed descriptors that leave the endpoint unset for the active speed; when the core attempts to read maxpacket, the null dereference triggers a panic. Listed threat actors in kernel memory corruption campaigns could target similar local paths but no public exploitation of this specific flaw is recorded.

How to fix it

Update the Linux kernel to version 4.19.320 or later, or apply commit ba15815dd24cc5ec0d23e2170dc58c7db1e03b4a. Rebuild and deploy the fixed kernel across affected systems.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release; inspect USB gadget initialization paths in source for the added descriptor check; test with intentionally malformed gadget descriptors to confirm no panic occurs.

Typical attack path

1. Obtain local access or control a gadget driver on the target system
2. Configure or load a USB gadget that fails to set the endpoint descriptor for the current speed
3. Trigger USB gadget initialization or speed change that calls the vulnerable maxpacket access
4. Cause null pointer dereference leading to kernel panic

How to detect it

Review kernel logs for null pointer panics or oops in usb/gadget/core.c; search dmesg and syslog for entries referencing unset descriptors or maxpacket access during gadget initialization.

What your security team should do

• Prioritize kernel upgrades on any systems exposing USB gadget interfaces
• Monitor for kernel oops or panic logs involving USB gadget core
• Audit custom gadget drivers for proper descriptor setup before deployment