usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.110, 6.18.51, 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop cc_debounce_dwork is queued from the set_cc() and start_toggling() callbacks, which run from TCPM's kthread worker. port_stop() returns before tcpm_unregister_port() destroys that worker. Flushing the worker during unregister may therefore run a callback which queues the delayed work after port_stop() has returned. The delayed work can then run after devres has freed pmic_typec_port. Use disable_delayed_work_sync() in port_stop() to cancel a pending instance and prevent the TCPM callbacks from queueing another one. This issue was found by an in-house static analysis tool.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From a4422ff221429c600c3dc5d0394fb3738b89d040 · fixed in 4359b5f95c93a4658e08368fa6fab9d89eb98447; From a4422ff221429c600c3dc5d0394fb3738b89d040 · fixed in c614d7c44ca7fb78867ba46b233acdb59287e8c8; From a4422ff221429c600c3dc5d0394fb3738b89d040 · fixed in 1ab669c2b44e1040ddfab7cd7f717aad580d17aa; From a4422ff221429c600c3dc5d0394fb3738b89d040 · fixed in 263f7d61a4201cde16849b2d016251806e7418be
- Linux Linux
6.5
- KernelLinux
From 6.5.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5