CVE-2024-56698

What it actually does

Incorrect handling of num_queued_sgs on partial SG request completion in dwc3 gadget driver allows access to non-existent SG entries, triggering null pointer dereference and memory corruption.

Why it matters to the business

Kernel instability or crashes on Linux systems using USB gadget mode, leading to denial of service and operational disruption; high ecosystem prevalence in downstream kernel dependents increases exposure urgency despite low EPSS.

How an attack unfolds

An attacker supplies USB gadget requests with scatter-gather lists that partially complete, causing the driver to miscalculate remaining entries and dereference a null pointer; threat actors in 2024 Zero-Day Exploitation Campaigns and Linux kernel memory issues have targeted similar kernel flaws.

How to fix it

Upgrade to fixed versions: org/pub/scm/linux/kernel/git/stable/linux.git commit 8ceb21d76426bbe7072cc3e43281e70c0d664cc7; for affected Ubuntu jasper packages apply 1.900.1-14ubuntu3.4 (14.04) or 1.900.1-debian1-2.4ubuntu1.1 (16.04).

How to confirm the fix worked

Confirm kernel source includes the referenced commit; exercise USB gadget SG request paths and verify no null dereference occurs on partial completions.

Typical attack path

1. Attach or interact with dwc3-based USB gadget device
2. Submit request containing multiple SG entries
3. Trigger partial completion to corrupt num_queued_sgs tracking
4. Force subsequent access to freed or non-existent SG entry
5. Induce null pointer dereference and kernel fault

How to detect it

Review kernel logs and dmesg for dwc3 gadget null pointer dereference entries; correlate with USB gadget activity around the published date or threat actor campaigns targeting Linux kernel memory issues.

What your security team should do

• Prioritize kernel updates on all systems exposing USB gadget functionality given 653 days since publication
• Monitor kernel logs for dwc3-related oops and panics
• Restrict USB gadget exposure where feasible until patched