CVE-2024-56687 is a vulnerability in the Linux kernel's USB subsystem, specifically affecting the musb (Mentor USB) gadget driver. The flaw arises from improper handling of USB endpoint request callbacks within the usb_ep_queue() function. According to the Linux kernel documentation, the callback function (req->complete) must never be called from within usb_ep_queue() to avoid deadlock situations. However, in this vulnerability, the callback can be invoked directly from usb_ep_queue(), leading to a hardware lockup scenario. The issue manifests when the USB gadget is initialized and a packet arrives while the request queue is empty. The RXPKTRDY hardware flag remains set even after the interrupt is handled, causing the endpoint to lock up and preventing further packet reception. This is particularly problematic for USB Ethernet gadgets, where the rx_complete() callback triggers network packet processing that can enable interrupts during the callback, perpetuating the lockup. The root cause is the interaction between interrupt handling and request queue management, which leads to a deadlock and hardware endpoint lockup. Several remediation approaches are discussed, including disabling interrupts during callbacks, modifying interrupt handlers to clear hardware flags, or flushing the Rx FIFO to ensure hardware readiness. The vulnerability affects Linux kernel versions identified by the commit hash baebdf48c360080710f80699eea3affbb13d6c65 and is relevant for systems using the musb USB gadget driver, often embedded devices or systems relying on USB Ethernet gadgets. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-56687 could be significant in environments where Linux-based embedded systems or devices using the musb USB gadget driver are deployed. This includes industrial control systems, IoT devices, network appliances, and specialized hardware that rely on USB Ethernet gadgets for connectivity. The hardware lockup caused by this vulnerability can lead to denial of service conditions on affected devices, disrupting network communications and potentially halting critical operations. In sectors such as manufacturing, telecommunications, healthcare, and transportation, where embedded Linux devices are common, this could result in operational downtime and loss of productivity. Furthermore, the inability to receive further USB packets might complicate remote management or updates, increasing maintenance costs and response times. Although no direct data breach or privilege escalation is indicated, the availability impact alone can be critical in time-sensitive or safety-critical applications. The complexity of the issue and its dependence on specific hardware and driver configurations mean that the threat is more acute in specialized deployments rather than general-purpose computing environments.

Mitigation requires applying the patch or update from the Linux kernel maintainers that addresses this issue by correcting the callback invocation and interrupt handling logic. Organizations should: 1) Identify all Linux systems using the musb USB gadget driver, particularly those employing USB Ethernet gadgets. 2) Update the Linux kernel to a version that includes the fix for CVE-2024-56687 or apply backported patches if available. 3) For embedded devices where kernel updates are challenging, consider disabling or replacing the affected USB gadget functionality if feasible. 4) Monitor device logs for symptoms of USB endpoint lockups or network interface failures indicative of this issue. 5) Implement network segmentation and redundancy to mitigate the impact of device unavailability. 6) Engage with device vendors to ensure firmware or kernel updates are provided promptly. 7) Avoid enabling IRQs within USB request callbacks in custom drivers or modules to prevent similar issues. These steps go beyond generic advice by focusing on the specific driver and hardware interaction causing the vulnerability.