CVE-2024-57915

What it actually does

Null pointer dereference in the u_serial gadget driver when gserial_disconnect clears the ioport during unbinding and a subsequent gs_read_complete call accesses the null port pointer after gadget reconfiguration.

Why it matters to the business

Kernel panic or system crash on Linux devices using USB gadget functionality, causing denial of service and potential loss of availability for systems relying on USB serial or gadget interfaces; high prevalence in Debian Linux environments increases exposure for servers and embedded devices.

How an attack unfolds

An attacker with local access or control over USB gadget configuration triggers an unbinding sequence that clears the port pointer, then induces a read completion callback path through dwc3 and UDC layers to dereference the null pointer and crash the kernel.

How to fix it

Upgrade the linux package on Debian 12 to version 6.1.128-1 or later to apply the fix that disables the endpoint before nulling the port.

How to confirm the fix worked

Verify the running kernel version is at least 6.1.128-1 on Debian 12 systems; inspect source for the ep disable before gserial_disconnect change in u_serial.c; test USB gadget bind/unbind sequences for stability.

Typical attack path

1. Perform USB gadget unbind or reconfiguration via configfs or UDC store operations
2. gserial_disconnect clears gser->ioport
3. Gadget reconfiguration calls gs_read_complete
4. Null pointer access occurs in gs_read_complete leading to crash

How to detect it

Review kernel logs for oops traces containing gs_read_complete, usb_gadget_giveback_request, dwc3_remove_requests, and udc_bind_to_driver; correlate with USB gadget configuration changes or unbind events.

What your security team should do

• Prioritize patching Debian 12 systems to linux 6.1.128-1 immediately due to kernel memory corruption risk
• Monitor for kernel oops or panic logs related to gs_read_complete and usb_gadget during USB operations
• Restrict unprivileged access to configfs and UDC configuration interfaces until patched