LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36977: usb: dwc3: Wait unconditionally after issuing EndXfer command

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Wait unconditionally after issuing EndXfer command Currently all controller IP/revisions except DWC3_usb3 >= 310a wait 1ms unconditionally for ENDXFER completion when IOC is not set. This is because DWC_usb3 controller revisions >= 3.10a supports GUCTL2[14: Rst_actbitlater] bit which allows polling CMDACT bit to know whether ENDXFER command is completed. Consider a case where an IN request was queued, and parallelly soft_disconnect was called (due to ffs_epfile_release). This eventually calls stop_active_transfer with IOC cleared, hence send_gadget_ep_cmd() skips waiting for CMDACT cleared during EndXfer. For DWC3 controllers with revisions >= 310a, we don't forcefully wait for 1ms either, and we proceed by unmapping the requests. If ENDXFER didn't complete by this time, it leads to SMMU faults since the controller would still be accessing those requests. Fix this by ensuring ENDXFER completion by adding 1ms delay in __dwc3_stop_active_transfer() unconditionally.

MediumCVSS 4.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-36977 is a Linux kernel USB controller timing bug. On affected systems, a local privileged user could trigger a race that leaves hardware accessing unmapped memory, causing SMMU faults and possible service disruption. The impact is availability, not data theft or tampering.

Executive priority

Treat as a moderate operational stability issue for affected Linux device fleets. Prioritize patching where USB gadget functionality is exposed or reliability is critical. It is not presented by the sources as a remote compromise or data-loss vulnerability.

Technical view

The issue is in the DWC3 USB gadget driver’s EndXfer handling. For DWC3 controller revisions >= 3.10a, the code could skip waiting for command completion when IOC was cleared, then unmap active requests too early. The fix adds an unconditional 1ms delay in __dwc3_stop_active_transfer().

Likely exposure

Most relevant to Linux-based embedded, mobile, appliance, or development systems using Synopsys DWC3 USB gadget functionality. Exposure is lower for systems without DWC3 hardware or USB gadget paths enabled. The provided data lists Linux kernel branches including 6.1, 6.6, 6.8, 6.9, and 6.10 as affected context.

Exploitation context

No KEV listing or cited source reports active exploitation. CVSS indicates local attack vector, high complexity, low privileges, no user interaction, and availability-only impact. Practical exploitation likely depends on access to affected USB gadget behavior and race timing.

Researcher notes

The source evidence describes a race between queued IN requests and soft_disconnect via ffs_epfile_release. The security effect is hardware DMA access after request unmapping, producing SMMU faults. Evidence does not identify exploit tooling, public exploitation, or non-Linux affected products.

Mitigation direction

  • Update to a Linux kernel or vendor build containing the referenced stable fixes.
  • Prioritize systems using DWC3 USB gadget or FunctionFS behavior.
  • If no update is available, check vendor guidance for supported backports or mitigations.
  • Avoid enabling vulnerable USB gadget functionality where it is not operationally required.

Validation and detection

  • Inventory Linux kernel versions and vendor patch levels on potentially exposed devices.
  • Confirm whether the platform uses DWC3 USB gadget controller functionality.
  • Verify the kernel source includes the unconditional EndXfer wait fix.
  • Review logs for SMMU faults around USB gadget disconnect or FunctionFS release events.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36977 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.7CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

4.7Medium
CVSS 3.1 vector shape for CVE-2024-36977Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb353eb6dc285a0775a447f53e5b2a50bf3f9684f, b353eb6dc285a0775a447f53e5b2a50bf3f9684f, b353eb6dc285a0775a447f53e5b2a50bf3f9684f, b353eb6dc285a0775a447f53e5b2a50bf3f9684f, b353eb6dc285a0775a447f53e5b2a50bf3f9684funaffected
LinuxLinux6.1, 0, 6.1.92, 6.6.32, 6.8.11, 6.9.2, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.