Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2023-52475
HistoryFeb 29, 2024 - 5:43 a.m.

CVE-2023-52475 Input: powermate - fix use-after-free in powermate_config_complete

2024-02-2905:43:08
Linux
github.com
2
linux kernel
powermate driver
use-after-free
memory free
usb
device disconnection

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct. When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial