CVE-2024-50075

What it actually does

Invalid memory access when USB virtualization is enabled on Tegra XUSB controllers; code uses the total USB2 PHY count instead of the per-VF root hub port count to index PORTSC registers, resulting in out-of-bounds kernel read during runtime suspend.

Why it matters to the business

Systems using affected Tegra XUSB hardware with USB virtualization may experience kernel panics and unexpected reboots, causing temporary loss of USB functionality and service disruption; low exploitation likelihood and no known ransomware use reduce urgency.

How an attack unfolds

An attacker with local access or the ability to trigger power-management events on a vulnerable Tegra-based system enables USB virtualization, then induces runtime suspend of the xHCI controller; the flawed port-number check in tegra_xusb_enter_elpg dereferences an invalid address, producing a kernel paging fault that can be used for denial of service or, with further primitives, local privilege escalation.

How to fix it

Upgrade the Linux kernel or affected QEMU package to a version containing the upstream fix; for Ubuntu 14.04 LTS systems running the listed qemu packages, install version 2.0.0+dfsg-2ubuntu1.19 or later. Disable USB virtualization on Tegra XUSB controllers if patching is not immediately possible.

How to confirm the fix worked

Confirm the installed kernel or qemu package version matches or exceeds the fixed release; reproduce a runtime-suspend cycle on a virtualized Tegra XUSB setup and verify absence of the paging-request fault in dmesg; review commit history for the xhci: tegra port-number correction.

Typical attack path

1. Obtain local execution or control over USB virtualization settings on a Tegra XUSB platform
2. Configure multiple Virtual Functions that share USB2 ports
3. Trigger runtime suspend via power-management or device removal
4. Execute tegra_xusb_enter_elpg which performs the incorrect PORTSC bounds check
5. Cause kernel paging fault leading to crash or potential memory corruption

How to detect it

Search kernel logs and dmesg for the exact paging-request fault address and the call trace containing tegra_xusb_enter_elpg, tegra_xusb_runtime_suspend, and rpm_suspend; correlate with USB virtualization configuration changes or runtime power events.

• Unable to handle kernel paging request at virtual address 006c622f7665642f
• tegra_xusb_enter_elpg+0x23c/0x658
• tegra_xusb_runtime_suspend+0x40/0x68
• f9461ae8 f8747908 b4ffff48 (f9400100)

What your security team should do

• Apply the fixed kernel or qemu package immediately on all Tegra-based systems
• Monitor EPSS and KEV feeds for any future increase in exploit activity
• Restrict local access and USB virtualization configuration to trusted administrators until patches are deployed
• Include the provided kernel oops signature in SIEM detection rules for retrospective hunting