Linux Kernel DWC2 Driver Use-After-Free Vulnerability in USB Debug Code

A use-after-free vulnerability has been identified in the Linux kernel's USB DWC2 driver, specifically within the debug code. This issue arises because the code improperly dereferences a USB request block (URB) after it has been handed back to the host controller, which can lead to undefined behavior or memory corruption. The vulnerability affects the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, potentially allowing for memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by modifying the DWC2 USB host controller driver to include debug statements that log the status of URBs. After a URB is processed and its status is returned to the host controller, the driver incorrectly logs the URB's status, which can lead to a use-after-free condition.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.