CVE-2023-4132: Kernel: smsusb: use-after-free caused by do_submit_urb()
A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.
Other sources
From the upstream fix below: When the siano device is plugged in, it may call the following functions to initialize the device.
smsusbprobe()-->smsusbinitdevice()-->smscorestartdevice().
When smscorestartdevice() gets failed, the function smsusbtermdevice() will be called and smsusbdevicet will be deallocated. Although we use usbkillurb() in smsusbstopstreaming() to cancel transfer requests and wait for them to finish, the worker threads that are scheduled by smsusbonresponse() may be still running. As a result, the UAF bugs could happen.
Upstream commits: https://github.com/torvalds/linux/commit/ebad8e731c1c06adf04621d6fd327b860c0861b5 https://github.com/torvalds/linux/commit/6f489a966fbeb0da63d45c2c66a8957eab604bf6
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw in the siano smsusb module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4132?
CVE-2023-4132 is a use-after-free vulnerability found in the siano smsusb module in the Linux kernel.
How does CVE-2023-4132 occur?
CVE-2023-4132 occurs during device initialization when the siano device is plugged in.
What is the impact of CVE-2023-4132?
The vulnerability allows a local user to crash the system, causing a denial of service condition.
Which software versions are affected by CVE-2023-4132?
CVE-2023-4132 affects the Linux kernel versions up to and including 6.2.16 and Redhat Enterprise Linux 8.0.
How can I fix CVE-2023-4132?
To fix CVE-2023-4132, update the kernel to version 6.3 or apply the appropriate security patches provided by the vendor.