CVE-2023-52781: usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
In the Linux kernel, the following vulnerability has been resolved:
usb: config: fix iteration issue in 'usbgetbosdescriptor()'
The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors.
Function 'usbgetbosdescriptor()' encounters an iteration issue when skipping the 'USBDTDEVICECAPABILITY' descriptor type. This results in the same descriptor being read repeatedly.
To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
usb: config: fix iteration issue in 'usbgetbosdescriptor()'
The Linux kernel CVE team has assigned CVE-2023-52781 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052153-CVE-2023-52781-8f04@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an iteration issue in 'usbgetbosdescriptor()'. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52781?
CVE-2023-52781 has been classified with a medium severity level due to the potential impact on USB descriptor handling in the Linux kernel.
How do I fix CVE-2023-52781?
To fix CVE-2023-52781, update your kernel to versions 5.10.203, 5.15.142, 6.1.66, 6.6.4, or 6.7 depending on your system.
Which systems are affected by CVE-2023-52781?
Systems running specific versions of the Linux kernel and IBM Security Verify Governance products are affected by CVE-2023-52781.
What does CVE-2023-52781 affect in the Linux kernel?
CVE-2023-52781 affects the USB subsystem, specifically how the kernel handles the iteration of BOS descriptors.
Is CVE-2023-52781 exploitable remotely?
CVE-2023-52781 does not appear to be directly exploitable remotely, but it could lead to local privilege escalation if successfully leveraged.