{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46674", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.247Z", "datePublished": "2024-09-13T05:29:10.381Z", "dateUpdated": "2026-08-05T11:37:53.435Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:53.435Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: st: fix probed platform device ref count on probe error path\n\nThe probe function never performs any paltform device allocation, thus\nerror path \"undo_platform_dev_alloc\" is entirely bogus. It drops the\nreference count from the platform device being probed. If error path is\ntriggered, this will lead to unbalanced device reference counts and\npremature release of device resources, thus possible use-after-free when\nreleasing remaining devm-managed resources." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The flaw is in a platform-driver probe path reached through local kernel/driver-model operations — boot-time/deferred probe, module load, or sysfs bind/unbind — and the resulting dangling device is subsequently touched through local sysfs paths. No network or physical USB interaction is involved, so Local is the accurate vector.\nAC:L - The unbalanced put_device() executes unconditionally on every probe error path, including the routine -EPROBE_DEFER from devm_reset_control_get_exclusive(), and each deferred-probe retry repeats it deterministically. No race must be won and no unpredictable state is required.\nPR:L - No credential or capability check exists on the code path itself — the refcount underflow is executed by the kernel's own probe machinery. A basic unprivileged local user can then reach and dereference the prematurely freed struct device through world-readable sysfs entries and groom the slab to reclaim the freed platform_object.\nUI:N - The reference imbalance and premature free occur automatically during probe/deferred re-probe with no victim action required. Nobody has to mount, open, or plug in anything.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on a kmalloc'd platform_object; after the slab is reclaimed, its contents are readable back through the device model and sysfs, enabling disclosure of arbitrary kernel heap data.\nI:H - The freed struct device is still dereferenced afterwards, including its dev->release, dev->bus, dev->type, and kobj ktype function pointers, so reclaiming the freed slab yields a write/control-flow-hijack primitive rather than mere data damage.\nA:H - The refcount underflow frees the device while devres_release_all(), sysfs teardown, and the deferred-probe list still reference it, producing an oops or panic; repeated probe retries compound the corruption." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/dwc3/dwc3-st.c" ], "versions": [ { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "b0979a885b9d4df2a25b88e9d444ccaa5f9f495c", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "f3498650df0805c75b4e1c94d07423c46cbf4ce1", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "6aee4c5635d81f4809c3b9f0c198a65adfbb2ada", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "060f41243ad7f6f5249fa7290dda0c01f723d12d", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "4c6735299540f3c82a5033d35be76a5c42e0fb18", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "1de989668708ce5875efc9d669d227212aeb9a90", "status": "affected", "versionType": "git" }, { "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "lessThan": "ddfcfeba891064b88bb844208b43bef2ef970f0c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/dwc3/dwc3-st.c" ], "versions": [ { "version": "3.18", "status": "affected" }, { "version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.321", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.283", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.225", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.166", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.108", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.49", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.8", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "4.19.321" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.4.283" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.10.225" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.15.166" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.108" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.6.49" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.10.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c" }, { "url": "https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1" }, { "url": "https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada" }, { "url": "https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d" }, { "url": "https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18" }, { "url": "https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49" }, { "url": "https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90" }, { "url": "https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c" } ], "title": "usb: dwc3: st: fix probed platform device ref count on probe error path", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T15:44:46.031544Z", "id": "CVE-2024-46674", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T15:45:00.520Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:16:08.133Z" } } ] } }