{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50075", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.940Z", "datePublished": "2024-10-29T00:50:17.304Z", "dateUpdated": "2026-08-05T11:41:25.758Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:25.758Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: tegra: fix checked USB2 port number\n\nIf USB virtualizatoin is enabled, USB2 ports are shared between all\nVirtual Functions. The USB2 port number owned by an USB2 root hub in\na Virtual Function may be less than total USB2 phy number supported\nby the Tegra XUSB controller.\n\nUsing total USB2 phy number as port number to check all PORTSC values\nwould cause invalid memory access.\n\n[ 116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f\n...\n[ 117.213640] Call trace:\n[ 117.216783] tegra_xusb_enter_elpg+0x23c/0x658\n[ 117.222021] tegra_xusb_runtime_suspend+0x40/0x68\n[ 117.227260] pm_generic_runtime_suspend+0x30/0x50\n[ 117.232847] __rpm_callback+0x84/0x3c0\n[ 117.237038] rpm_suspend+0x2dc/0x740\n[ 117.241229] pm_runtime_work+0xa0/0xb8\n[ 117.245769] process_scheduled_works+0x24c/0x478\n[ 117.251007] worker_thread+0x23c/0x328\n[ 117.255547] kthread+0x104/0x1b0\n[ 117.259389] ret_from_fork+0x10/0x20\n[ 117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The faulting path is the Tegra XUSB controller's runtime-PM autosuspend/system-suspend handler on the local SoC; there is no network, adjacent, or remote-peer data path into `tegra_xusb_enter_elpg()`, and no USB device needs to be attached since the loop runs precisely when all root-hub ports are already suspended.\nAC:L - On an affected platform (Tegra XUSB with USB virtualization, where a VF root hub reports fewer USB2 ports than `tegra->num_usb_phys`) the out-of-bounds index is taken deterministically on every ELPG entry — no race, no timing window, and the 2 s autosuspend guarantees it fires repeatedly during ordinary idle.\nPR:N - The out-of-bounds read and wild dereference happen inside `pm_runtime_work`/`tegra_xusb_runtime_suspend()` on a kernel workqueue, driven autonomously by the PM core when the controller goes idle; no account, capability, or namespace privilege gates the path in any way.\nUI:N - Autosuspend after the 2000 ms idle delay is initiated by the driver core itself, so the fault manifests with no victim action — no device plug, mount, or file access is required.\nS:U - The over-read and the resulting dereference are confined to the kernel heap and MMIO of the same kernel security authority; even in the virtualized Tegra case the guest driver's access stays within guest page tables/SMMU and crosses no hypervisor, IOMMU, or sandbox boundary.\nC:H - The loop reads slab bytes past the end of the `kcalloc`'d `usb2_rhub.ports` array and then performs two chained dereferences at addresses the kernel never validated (`*(void **)p`, then `readl()`), an unbounded read from an uncontrolled kernel/MMIO address rather than a small fixed-size over-read, and the resulting value is partially observable through the per-port UTMI pad power state programmed at resume.\nI:L - No out-of-bounds write or control-flow primitive exists, but out-of-bounds-derived data directly sets `tegra->lp0_utmi_pad_mask`, which `tegra_xhci_program_utmi_power_lp0_exit()` uses to power UTMI pads on/off, and the unvalidated `readl()` can strike read-to-clear registers of an unrelated device's MMIO, giving limited corruption of kernel and hardware state.\nA:H - The commit documents a hard kernel oops (\"Unable to handle kernel paging request at virtual address 006c622f7665642f\") in `tegra_xusb_enter_elpg+0x23c`, killing the PM worker while holding `tegra->lock` so the controller can never suspend or resume again, and producing a full panic on `panic_on_oops` systems typical of automotive/embedded Tegra deployments." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/host/xhci-tegra.c" ], "versions": [ { "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56", "lessThan": "9c696bf4ab54c7cec81221887564305f0ceeac0a", "status": "affected", "versionType": "git" }, { "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56", "lessThan": "c46555f14b71f95a447f5d49fc3f1f80a1472da2", "status": "affected", "versionType": "git" }, { "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56", "lessThan": "7d381137cb6ecf558ef6698c7730ddd482d4c8f2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/host/xhci-tegra.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.58", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.5", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.58" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.11.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9c696bf4ab54c7cec81221887564305f0ceeac0a" }, { "url": "https://git.kernel.org/stable/c/c46555f14b71f95a447f5d49fc3f1f80a1472da2" }, { "url": "https://git.kernel.org/stable/c/7d381137cb6ecf558ef6698c7730ddd482d4c8f2" } ], "title": "xhci: tegra: fix checked USB2 port number", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50075", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:23:31.784076Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:27:21.340Z" } } ] } }