In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: rndis: add spinlock for rndis response list

There's no lock for rndis response list. It could cause list corruption
if there're two different list_add at the same time like below.
It's better to add in rndis_add_response / rndis_free_response
/ rndis_get_next_response to prevent any race condition on response list.

[ 361.894299] [1: irq/191-dwc3:16979] list_add corruption.
next->prev should be prev (ffffff80651764d0),
but was ffffff883dc36f80. (next=ffffff80651764d0).

[ 361.904380] [1: irq/191-dwc3:16979] Call trace:
[ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90
[ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0
[ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84
[ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4
[ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60
[ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0
[ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc
[ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc
[ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec
[ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00028.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f6281af9d62e128aa6efad29cf7265062af114f2 affected < 9f5d8ba538ef81cd86ea587ca3f8c77e26bea405
f6281af9d62e128aa6efad29cf7265062af114f2 affected < 669c2b178956718407af5631ccbc61c24413f038
f6281af9d62e128aa6efad29cf7265062af114f2 affected < 9f688aadede6b862a0a898792b1a35421c93636f
f6281af9d62e128aa6efad29cf7265062af114f2 affected < 9ab652d41deab49848673c3dadb57ad338485376
f6281af9d62e128aa6efad29cf7265062af114f2 affected < 4ce247af3f30078d5b97554f1ae6200a0222c15a
f6281af9d62e128aa6efad29cf7265062af114f2 affected < da514063440b53a27309a4528b726f92c3cfe56f
f6281af9d62e128aa6efad29cf7265062af114f2 affected < 33222d1571d7ce8c1c75f6b488f38968fa93d2d9
f6281af9d62e128aa6efad29cf7265062af114f2 affected < aaaba1c86d04dac8e49bf508b492f81506257da3
Linux Linux affected
Version Status Constraints
4.6 affected —
0 unaffected < 4.6
4.9.304 unaffected ≤ 4.9.*
4.14.269 unaffected ≤ 4.14.*
4.19.232 unaffected ≤ 4.19.*
5.4.182 unaffected ≤ 5.4.*
5.10.103 unaffected ≤ 5.10.*
5.15.26 unaffected ≤ 5.15.*
5.16.12 unaffected ≤ 5.16.*
5.17 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/33222d1571d7ce8c1c75f6b488f38968fa93d2d9 cve-icon cve-icon
https://git.kernel.org/stable/c/4ce247af3f30078d5b97554f1ae6200a0222c15a cve-icon cve-icon
https://git.kernel.org/stable/c/669c2b178956718407af5631ccbc61c24413f038 cve-icon cve-icon
https://git.kernel.org/stable/c/9ab652d41deab49848673c3dadb57ad338485376 cve-icon cve-icon
https://git.kernel.org/stable/c/9f5d8ba538ef81cd86ea587ca3f8c77e26bea405 cve-icon cve-icon
https://git.kernel.org/stable/c/9f688aadede6b862a0a898792b1a35421c93636f cve-icon cve-icon
https://git.kernel.org/stable/c/aaaba1c86d04dac8e49bf508b492f81506257da3 cve-icon cve-icon
https://git.kernel.org/stable/c/da514063440b53a27309a4528b726f92c3cfe56f cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024082220-CVE-2022-48926-e8ce@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-48926 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-48926 cve-icon
History

Thu, 26 Sep 2024 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-414

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Aug 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 22 Aug 2024 22:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Thu, 22 Aug 2024 03:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c
Title usb: gadget: rndis: add spinlock for rndis response list
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T08:26:14.492Z

Reserved: 2024-08-21T06:06:23.297Z

Link: CVE-2022-48926

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:15.624Z

cve-icon NVD

Status : Analyzed

Published: 2024-08-22T04:15:15.363

Modified: 2024-08-23T02:05:14.960

Link: CVE-2022-48926

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-08-22T00:00:00Z

Links: CVE-2022-48926 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses