CVE-2024-46674 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-46674?

CVE-2024-46674 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's DWC3 USB driver for STMicroelectronics platforms could allow local attackers to crash the system or potentially execute arbitrary code. This affects Linux systems with specific USB hardware configurations where the driver probe function fails. Attackers need local access to exploit this vulnerability.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's DWC3 USB driver for STMicroelectronics platforms could allow local attackers to crash the system or potentially execute arbitrary code. This affects Linux systems with specific USB hardware configurations where the driver probe function fails. Attackers need local access to exploit this vulnerability.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions with the vulnerable DWC3 ST driver code (exact range depends on distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with STMicroelectronics DWC3 USB hardware and when the driver probe function encounters an error condition.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation leading to kernel compromise, system crash, or arbitrary code execution with kernel privileges.

🟠

Likely Case

Kernel panic or system crash when USB device initialization fails, causing denial of service.

🟢

If Mitigated

Limited impact with proper access controls preventing local attackers from triggering the vulnerable code path.

🌐 Internet-Facing: LOW - Requires local system access, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local attackers with shell access could potentially exploit this to crash systems or escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger specific USB driver initialization failures. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 060f41243ad7f6f5249fa7290dda0c01f723d12d, 1de989668708ce5875efc9d669d227212aeb9a90, 4c6735299540f3c82a5033d35be76a5c42e0fb18, 6aee4c5635d81f4809c3b9f0c198a65adfbb2ada, b0979a885b9d4df2a25b88e9d444ccaa5f9f495c

Vendor Advisory: https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply the relevant git commits. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable affected USB controller

linux

Prevent loading of the vulnerable DWC3 ST driver module

echo 'blacklist dwc3-st' > /etc/modprobe.d/disable-dwc3-st.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict local user access to prevent triggering vulnerable code paths
Implement strict USB device connection policies to reduce driver initialization failures

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if DWC3 ST driver is loaded: 'uname -r' and 'lsmod | grep dwc3'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check for presence of fix commits in kernel source

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages related to USB/DWC3 driver
System crashes during USB device initialization

Network Indicators:

None - local vulnerability only

SIEM Query:

search 'kernel: BUG:' OR 'kernel: Oops:' AND 'dwc3' OR 'usb'

📊 Metadata

CVE ID: CVE-2024-46674

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: September 13, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-46674, you might also want to check these: