CVE-2023-1079: Use After Free
A flaw was found in the Linux kernel. A use-after-free may be triggered in asuskbdbacklightset when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the workstruct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asuskbdleds led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4ab3a086d10eeec1424f2e8a968827a6336203df
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw flaw in the asuskbdbacklightset function. By using a specially-crafted USB device, a physical attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1079?
CVE-2023-1079 has been classified as a medium severity vulnerability due to its potential exploitation through malicious USB devices.
How do I fix CVE-2023-1079?
To fix CVE-2023-1079, update the Linux kernel to version 6.3 or later, or apply the appropriate patches provided by your distribution.
What systems are affected by CVE-2023-1079?
CVE-2023-1079 affects the Linux kernel versions prior to 6.3, as well as specific IBM Security Verify Governance components up to version ISVG 10.0.2.
What exploit techniques are associated with CVE-2023-1079?
CVE-2023-1079 could be exploited through a use-after-free vulnerability triggered by connecting or disconnecting a malicious USB device.
Are there any known exploits for CVE-2023-1079?
As of now, there are no publicly available exploits specifically targeting CVE-2023-1079.