CVE-2023-37453: Medium severity Linux Linux kernel vulnerability
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in readdescriptors in drivers/usb/core/sysfs.c.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds flaw in the readdescriptors function in drivers/usb/core/sysfs.c in the USB subsystem. By using a specially crafted USB device, a physical attacker could exploit this vulnerability to cause the system to crash.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37453?
CVE-2023-37453 is classified as a high-severity vulnerability due to the potential for out-of-bounds access leading to system crashes.
How do I fix CVE-2023-37453?
To fix CVE-2023-37453, upgrade the Linux kernel to version 6.4.3 or later, or apply the relevant patches provided by your Linux distribution.
Which versions of the Linux kernel are affected by CVE-2023-37453?
CVE-2023-37453 affects the Linux kernel versions up to and including 6.4.2.
What components are impacted by CVE-2023-37453?
CVE-2023-37453 impacts the USB subsystem in the Linux kernel, specifically the read_descriptors function.
Is there a workaround for CVE-2023-37453 while updates are applied?
As of now, there are no known workarounds for CVE-2023-37453, and updating the kernel is the recommended action.