CVE-2024-45006 is a vulnerability identified in the Linux kernel's USB xHCI (Extensible Host Controller Interface) driver, specifically affecting the handling of full-speed USB devices during re-enumeration after a failed address device command. The vulnerability arises from improper handling of bandwidth table pointers within the xhci_configure_endpoint() function when the xHC (xHCI host controller) address device command fails. In this scenario, a new xhci_virt_device structure is allocated to re-enable the USB slot, but the bandwidth table pointers are not correctly initialized. Subsequently, when usb_ep0_reinit() is called to reconfigure endpoint 0 (the default control endpoint) and xhci_configure_endpoint() attempts to check and reserve bandwidth, it dereferences a NULL pointer, leading to a kernel NULL pointer dereference and a kernel oops (crash). This bug is specific to Panther Point xHC implementations, where bandwidth reservation is handled in software rather than hardware as in other hosts. The vulnerability can be triggered by connecting or re-enumerating full-speed USB devices that require endpoint 0 Max Packet Size reconfiguration, especially if the device does not respond properly to the setup address command. The kernel crash results in a denial of service (DoS) condition, potentially destabilizing systems relying on the affected Linux kernel versions. The patch involves ensuring bandwidth table pointers are properly set after a failed address device command and avoiding bandwidth checks when only the default control endpoint context is evaluated without actual endpoint changes. This vulnerability affects multiple Linux kernel versions identified by the commit hash 651aaf36a7d7b36a58980e70133f9437d4f6d312 and was published on September 4, 2024. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily in environments where Linux systems are used with USB devices, including servers, workstations, and embedded systems. The vulnerability can be exploited unintentionally by connecting or re-enumerating certain full-speed USB devices that fail the address device command, causing kernel crashes and system instability. This can lead to denial of service conditions, disrupting critical operations, especially in sectors relying on Linux-based infrastructure such as telecommunications, finance, manufacturing, and public services. The impact is heightened in environments with high USB device turnover or automated USB device management. While the vulnerability does not appear to allow privilege escalation or remote code execution, the resulting kernel crash can cause downtime, data loss, or interruption of services. Systems handling sensitive or real-time data may be particularly affected. The lack of known exploits reduces immediate risk, but the vulnerability's presence in widely deployed Linux kernels means organizations must act promptly to prevent potential exploitation or accidental triggering.

European organizations should prioritize updating their Linux kernel to the patched versions that address CVE-2024-45006 as soon as they become available from their Linux distribution vendors. Until patches are applied, organizations should implement the following mitigations: 1) Restrict or monitor the use of full-speed USB devices, especially those that are untrusted or frequently connected/disconnected, to reduce the chance of triggering the vulnerability. 2) Employ USB device whitelisting or endpoint security solutions to control USB device enumeration and prevent unauthorized devices from connecting. 3) For critical systems, consider disabling USB ports where feasible or using hardware-based USB port control to limit exposure. 4) Monitor system logs for kernel oops or USB-related errors indicative of attempted exploitation or accidental triggering. 5) Engage with Linux distribution security advisories and subscribe to vendor notifications to ensure timely patch deployment. 6) In virtualized or containerized environments, isolate USB device passthrough carefully to limit impact scope. These steps go beyond generic advice by focusing on controlling USB device interactions and monitoring specific kernel behaviors related to this vulnerability.