Vulnerability identifier: #VU93611

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52781

CWE-ID: CWE-682

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the usb_get_bos_descriptor() function in drivers/usb/core/config.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/9ef94ec8e52eaf7b9abc5b5f8f5b911751112223
http://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702
http://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91
http://git.kernel.org/stable/c/7c0244cc311a4038505b73682b7c8ceaa5c7a8c8
http://git.kernel.org/stable/c/974bba5c118f4c2baf00de0356e3e4f7928b4cbc

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.