The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: dwc2: fix a devres leak in hw_enable upon suspend resume Each time the platform goes to low power, PM     suspend / resume routines call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). This adds a new     devres each time. This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from     udc_start(). This can be seen with tracing: - echo 1 >     /sys/kernel/debug/tracing/events/dev/devres_log/enable - go to low power - cat     /sys/kernel/debug/tracing/trace A new ADD entry is found upon each low power cycle: ... devres_log:
    49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf     devm_action_release (8 bytes) ... A second issue is addressed here: - regulator_bulk_enable() is called     upon each PM cycle (suspend/resume). - regulator_bulk_disable() never gets called. So the reference count     for these regulators constantly increase, by one upon each low power cycle, due to missing     regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable(). The original fix that introduced the     devm_add_action_or_reset() call, fixed an issue during probe, that happens due to other errors in     dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without disabling regulators, when dr_mode     == USB_DR_MODE_PERIPHERAL. Rather fix the error path: disable all the low level hardware in the error     path, by using the hsotg->ll_hw_enabled flag. Checking dr_mode has been introduced to avoid a dual call     to dwc2_lowlevel_hw_disable(). ll_hw_enabled should achieve the same (and is used currently in the     remove() routine). (CVE-2023-53054)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2023-53054

medium Nessus Plugin ID 244948

Version 1.2