CVE-2024-46675

What it actually does

During runtime suspend on affected Exynos platforms, a timeout when halting the USB core can cause dwc3_core_exit to clear the event buffer address while the core remains active, allowing subsequent USB core access to an invalid address and resulting in SMMU faults or memory corruption.

Why it matters to the business

Systems using vulnerable Linux kernels on Exynos hardware may experience unexpected faults, instability, or crashes during USB device suspend/resume cycles, leading to reduced reliability and potential operational downtime; low EPSS and no KEV listing indicate limited active exploitation risk but still require patching for affected deployments.

How an attack unfolds

An attacker with local access triggers runtime suspend conditions on a vulnerable kernel, exploiting the window where the USB core remains active after a halt timeout; this leads the core to dereference a cleared event buffer address, producing SMMU faults or memory issues. Threat actor mentions of 2024 zero-day campaigns and Linux kernel resource mishandling provide context but no confirmed public exploits for this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit eca3f543f817da87c00d1a5697b473efb548204f or later; rebuild and deploy the fixed kernel image, then reboot affected systems. For environments with github.com/minio/minio, ensure version 0.0.0-202303200735 or newer is used if applicable.

How to confirm the fix worked

Verify the running kernel includes commit eca3f543f817da87c00d1a5697b473efb548204f via git log or kernel version string; test runtime suspend/resume cycles on Exynos hardware and confirm absence of SMMU faults or invalid event buffer accesses in kernel logs.

Typical attack path

1. Obtain local access to a target system running a vulnerable kernel on Exynos hardware
2. Trigger or wait for USB runtime suspend conditions
3. Force a timeout during dwc3_gadget_suspend halt sequence
4. Cause dwc3_core_exit to clear the event buffer while the core is still active
5. Observe SMMU fault or memory corruption from invalid event buffer access

How to detect it

Review kernel logs for SMMU faults or USB event buffer related errors during suspend events; correlate with dwc3 driver activity on Exynos platforms. Check for presence of unpatched kernels via package managers or kernel version checks.

What your security team should do

• Prioritize kernel updates on all Exynos-based systems within standard change windows given the memory corruption classification
• Monitor EPSS trend (stable at ~0.0028) and threat actor reports for any increase in exploitation activity
• Test suspend behavior post-update to validate the fix before broad rollout
• Include the fixed commit identifier in patch management and vulnerability scanning policies