CVE-2023-1073: Buffer Overflow
A flaw found in the Linux Kernel. The missing check causes a type confusion when issuing a listentry() on an empty reportlist. The problem is caused by the assumption that the device must have valid reportlist. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption.
References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=b12fece4c64857e5fab4290bf01b2e0317a88456 https://www.openwall.com/lists/oss-security/2023/01/17/3
Other sources
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.
— Launchpad
Linux Kernel could allow a physical authenticated attacker to gain elevated privileges on the system, caused by a memory corruption flaw in the human interface device (HID) subsystem. By using a specially crafted USB device , an attacker could exploit this vulnerability to gain elevated privileges or cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1073?
CVE-2023-1073 is considered to have a critical severity due to its potential exploitation by malicious devices.
How do I fix CVE-2023-1073?
To fix CVE-2023-1073, you should upgrade your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1, depending on your distribution.
Which systems are affected by CVE-2023-1073?
CVE-2023-1073 affects various Linux kernel versions across distributions such as Red Hat Enterprise Linux 7.0-9.0 and Fedora 37.
What causes CVE-2023-1073 vulnerability?
CVE-2023-1073 is caused by a missing check in the Linux kernel, leading to type confusion when the list_entry() function is executed on an empty report_list.
Can CVE-2023-1073 be exploited remotely?
Yes, CVE-2023-1073 can be exploited by a suitably malicious device connected to the system.