CVE-2024-36977: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's USB DWC3 driver has been identified and assigned CVE-2024-36977. The issue affects the handling of EndXfer commands in the USB subsystem, specifically in the DesignWare USB3 driver. The vulnerability was discovered and resolved in June 2024 (NVD).

The vulnerability occurs in the USB DWC3 driver's handling of EndXfer commands. Previously, only controller IP/revisions except DWC3_usb3 >= 310a would wait 1ms unconditionally for ENDXFER completion when IOC (Interrupt On Complete) is not set. For DWC3 controllers with revisions >= 3.10a, the GUCTL2[14: Rst_actbitlater] bit allows polling CMDACT bit to determine ENDXFER command completion. However, when an IN request is queued and soft_disconnect is called (due to ffs_epfile_release), stop_active_transfer is called with IOC cleared, causing the driver to skip waiting for CMDACT cleared during EndXfer (Kernel Commit).

If the ENDXFER command doesn't complete before proceeding with request unmapping, it can lead to SMMU (System Memory Management Unit) faults as the controller may still be accessing those requests. This could potentially affect system stability and cause memory-related issues (Kernel Commit).

The vulnerability requires local access and specific timing conditions involving USB operations. According to CISA's assessment, it has been assigned a CVSS v3.1 Base Score of 4.7 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The issue has been fixed by ensuring ENDXFER completion through adding an unconditional 1ms delay in __dwc3_stop_active_transfer(). The fix has been implemented in the Linux kernel, and users should update to patched versions. The patch modifies the drivers/usb/dwc3/gadget.c file to implement this delay consistently across all controller versions (Kernel Commit).