一、漏洞信息
漏洞编号：CVE-2023-52855
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:usb: dwc2: fix possible NULL pointer dereference caused by driver concurrencyIn _dwc2_hcd_urb_enqueue(), urb->hcpriv = NULL is executed withoutholding the lock hsotg->lock . In _dwc2_hcd_urb_dequeue(): spin_lock_irqsave(&hsotg->lock, flags); ... if (!urb->hcpriv) { dev_dbg(hsotg->dev, ## urb->hcpriv is NULL ## n ); goto out; } rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv ...out: spin_unlock_irqrestore(&hsotg->lock, flags);When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() areconcurrently executed, the NULL check of urb->hcpriv can be executedbefore urb->hcpriv = NULL . After urb->hcpriv is NULL, it can be usedin the function call to dwc2_hcd_urb_dequeue(), which can cause a NULLpointer dereference.This possible bug is found by an experimental static analysis tooldeveloped by myself. This tool analyzes the locking APIs to extractfunction pairs that can be concurrently executed, and then analyzes theinstructions in the paired functions to identify possible concurrencybugs including data races and atomicity violations. The above possiblebug is reported, when my tool analyzes the source code of Linux 6.5.To fix this possible bug, urb->hcpriv = NULL should be executed withholding the lock hsotg->lock . After using this patch, my tool neverreports the possible bug, with the kernelconfiguration allyesconfig forx86_64. Because I have no associated hardware, I cannot test the patchin runtime testing, and just verify it according to the code logic.
漏洞公开时间：2024-05-22 00:15:22
漏洞创建时间：2024-05-22 23:05:55
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-52855

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4(5.10.0):
10.openEuler-24.03-LTS(6.6.0):
11.openEuler-24.03-LTS-Next(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP1(4.19.90):
3.openEuler-20.03-LTS-SP4(4.19.90):
4.openEuler-22.03-LTS(5.10.0):
5.openEuler-22.03-LTS-Next(5.10.0):
6.openEuler-22.03-LTS-SP1(5.10.0):
7.openEuler-22.03-LTS-SP2(5.10.0):
8.openEuler-22.03-LTS-SP3(5.10.0):
9.openEuler-22.03-LTS-SP4(5.10.0):
10.openEuler-24.03-LTS(6.6.0):
11.openEuler-24.03-LTS-Next(6.6.0):