Vulnerability identifier: #VU20807

Vulnerability risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14763

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to double-locking error in the DesignWare USB3 DRD Controller device in "drivers/usb/dwc3/gadget.c". An authenticated local user with physical access to the system can exploit this vulnerability to cause a deadlock with "f_hid", resulting in a denial of service condition.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: 4.16 - 4.16.3

---

External links
http://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.4
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=072684e8c58d17e853f8e8b9f6d9ce2e58d2b036
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c91815b596245fd7da349ecc43c8def670d2269e
http://github.com/torvalds/linux/commit/072684e8c58d17e853f8e8b9f6d9ce2e58d2b036
http://github.com/torvalds/linux/commit/c91815b596245fd7da349ecc43c8def670d2269e

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.