CVE-2024-56670

What it actually does

Race condition in Linux kernel usb gadget u_serial driver allows concurrent gs_open and gserial_disconnect to set port->port_usb to NULL, leading to null pointer dereference crash in gs_start_io when gs_free_requests is called.

Why it matters to the business

Local denial of service via kernel crash on systems using USB gadget serial functions; high prevalence in Linux environments increases operational disruption risk, with urgency for patching despite low exploit maturity.

How an attack unfolds

An attacker with local access or ability to trigger USB gadget unbind concurrently with serial port open operations races gs_open against gserial_disconnect to dereference a null port_usb pointer, causing a crash; listed threat actors in Linux kernel campaigns could potentially adapt similar race techniques though no public exploit exists.

How to fix it

Upgrade Linux kernel to commit 4efdfdc32d8d6307f968cd99f1db64468471bab1 or later stable release containing the null check in gs_start_io; apply equivalent fixed packages for affected distributions.

How to confirm the fix worked

Confirm kernel source includes the added null pointer check before port_usb access in gs_start_io; verify running kernel version incorporates the fix commit and test concurrent open/disconnect scenarios do not crash.

Typical attack path

1. Gain local execution or USB gadget interaction capability on target
2. Trigger multi-threaded access to u_serial port via open while forcing gadget disconnect/unbind
3. Race window allows port_usb to be nulled before gs_free_requests access
4. Kernel panics due to null dereference in gs_start_io

How to detect it

Review kernel crash logs for gs_start_io call traces involving null port_usb; inspect audit or system logs for concurrent gadget disconnect and serial open events around panic times.

What your security team should do

• Prioritize kernel upgrades on all systems exposing USB gadget serial functionality
• Monitor for local privilege or gadget manipulation attempts pending patch deployment
• Review USB gadget configurations to minimize unnecessary serial port exposure