CVE-2024-46674 (GCVE-0-2024-46674)
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2026-08-05 11:37
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: st: fix probed platform device ref count on probe error path The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources.
References
Impacted products
Vendor Product Version
Linux Linux Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
Version: f83fca0707c66e36f14efef7f68702cb12de70b7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:44:46.031544Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:45:00.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:08.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/dwc3-st.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0979a885b9d4df2a25b88e9d444ccaa5f9f495c",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "f3498650df0805c75b4e1c94d07423c46cbf4ce1",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "6aee4c5635d81f4809c3b9f0c198a65adfbb2ada",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "060f41243ad7f6f5249fa7290dda0c01f723d12d",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "4c6735299540f3c82a5033d35be76a5c42e0fb18",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "1de989668708ce5875efc9d669d227212aeb9a90",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "ddfcfeba891064b88bb844208b43bef2ef970f0c",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/dwc3-st.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.321",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.321",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.283",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.225",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.108",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.49",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: st: fix probed platform device ref count on probe error path\n\nThe probe function never performs any paltform device allocation, thus\nerror path \"undo_platform_dev_alloc\" is entirely bogus.  It drops the\nreference count from the platform device being probed.  If error path is\ntriggered, this will lead to unbalanced device reference counts and\npremature release of device resources, thus possible use-after-free when\nreleasing remaining devm-managed resources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in a platform-driver probe path reached through local kernel/driver-model operations \u2014 boot-time/deferred probe, module load, or sysfs bind/unbind \u2014 and the resulting dangling device is subsequently touched through local sysfs paths. No network or physical USB interaction is involved, so Local is the accurate vector.\nAC:L - The unbalanced put_device() executes unconditionally on every probe error path, including the routine -EPROBE_DEFER from devm_reset_control_get_exclusive(), and each deferred-probe retry repeats it deterministically. No race must be won and no unpredictable state is required.\nPR:L - No credential or capability check exists on the code path itself \u2014 the refcount underflow is executed by the kernel\u0027s own probe machinery. A basic unprivileged local user can then reach and dereference the prematurely freed struct device through world-readable sysfs entries and groom the slab to reclaim the freed platform_object.\nUI:N - The reference imbalance and premature free occur automatically during probe/deferred re-probe with no victim action required. Nobody has to mount, open, or plug in anything.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on a kmalloc\u0027d platform_object; after the slab is reclaimed, its contents are readable back through the device model and sysfs, enabling disclosure of arbitrary kernel heap data.\nI:H - The freed struct device is still dereferenced afterwards, including its dev-\u003erelease, dev-\u003ebus, dev-\u003etype, and kobj ktype function pointers, so reclaiming the freed slab yields a write/control-flow-hijack primitive rather than mere data damage.\nA:H - The refcount underflow frees the device while devres_release_all(), sysfs teardown, and the deferred-probe list still reference it, producing an oops or panic; repeated probe retries compound the corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:53.435Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49"
        },
        {
          "url": "https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c"
        }
      ],
      "title": "usb: dwc3: st: fix probed platform device ref count on probe error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46674",
    "datePublished": "2024-09-13T05:29:10.381Z",
    "dateReserved": "2024-09-11T15:12:18.247Z",
    "dateUpdated": "2026-08-05T11:37:53.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:16:08.133Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46674\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:44:46.031544Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:44:50.342Z\"}}], \"cna\": {\"title\": \"usb: dwc3: st: fix probed platform device ref count on probe error path\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"b0979a885b9d4df2a25b88e9d444ccaa5f9f495c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"f3498650df0805c75b4e1c94d07423c46cbf4ce1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"6aee4c5635d81f4809c3b9f0c198a65adfbb2ada\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"060f41243ad7f6f5249fa7290dda0c01f723d12d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"4c6735299540f3c82a5033d35be76a5c42e0fb18\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"1de989668708ce5875efc9d669d227212aeb9a90\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"ddfcfeba891064b88bb844208b43bef2ef970f0c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/dwc3/dwc3-st.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.321\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.283\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.225\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.166\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.108\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.49\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/dwc3/dwc3-st.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c\"}, {\"url\": \"https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1\"}, {\"url\": \"https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada\"}, {\"url\": \"https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d\"}, {\"url\": \"https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18\"}, {\"url\": \"https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49\"}, {\"url\": \"https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90\"}, {\"url\": \"https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: dwc3: st: fix probed platform device ref count on probe error path\\n\\nThe probe function never performs any paltform device allocation, thus\\nerror path \\\"undo_platform_dev_alloc\\\" is entirely bogus.  It drops the\\nreference count from the platform device being probed.  If error path is\\ntriggered, this will lead to unbalanced device reference counts and\\npremature release of device resources, thus possible use-after-free when\\nreleasing remaining devm-managed resources.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.321\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.283\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.225\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.166\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.108\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.49\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.8\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:34:12.536Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46674\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:34:12.536Z\", \"dateReserved\": \"2024-09-11T15:12:18.247Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T05:29:10.381Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.