Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-52478— HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于接收器 USB 断开连接时会导致内核崩溃。

CVSS 8.8 · High EPSS 0.25% · P15

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c39e3d5fc9dd3e16c6f59dd94d827540040de66d< ca0c4cc1d215dc22ab0e738c9f017c650f3183f5 affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< 44481b244fcaa2b895a53081d6204c574720c38c affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< cd0e2bf7fb22fe9b989c59c42dca06367fd10e6b affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< 093af62c023537f097d2ebdfaa0bc7c1a6e874e1 affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< 28ddc1e0b898291323b62d770b1b931de131a528 affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< fd72ac9556a473fc7daf54efb6ca8a97180d621d affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< f7b2c7d9831af99369fe8ad9b2a68d78942f414e affected
c39e3d5fc9dd3e16c6f59dd94d827540040de66d< dac501397b9d81e4782232c39f94f4307b137452 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-52478

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by the hw when the thread running hidpp_connect_event() from probe() is waiting on the hw, then a second thread running hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) { hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /* Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input = hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ... hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The first registered power supply class device gets unregistered, this involves sending a remove uevent to userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于接收器 USB 断开连接时会导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c39e3d5fc9dd3e16c6f59dd94d827540040de66d ~ ca0c4cc1d215dc22ab0e738c9f017c650f3183f5 -
Linux Linux 3.19 -

II. Public POCs for CVE-2023-52478

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-52478

请登录查看更多情报信息。

Other References for CVE-2023-52478 (7)

Same Patch Batch · Linux · 2024-02-29 · 53 CVEs total

CVE-2023-52480 9.8 CRITICAL ksmbd: fix race condition between session lookup and expire
CVE-2023-52479 8.8 HIGH ksmbd: fix uaf in smb20_oplock_break_ack
CVE-2024-26620 8.2 HIGH s390/vfio-ap: always filter entire AP matrix
CVE-2024-26617 7.8 HIGH fs/proc/task_mmu: move mmu notification mechanism inside mm lock
CVE-2023-52483 7.8 HIGH mctp: perform route lookups under a RCU read-side lock
CVE-2023-52486 7.8 HIGH drm: Don't unref the same fb many times by mistake due to deadlock handling
CVE-2021-47061 7.8 HIGH KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
CVE-2021-47060 7.8 HIGH KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
CVE-2023-52491 7.8 HIGH media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_
CVE-2024-26608 7.8 HIGH ksmbd: fix global oob in ksmbd_nl_policy
CVE-2024-26610 7.8 HIGH wifi: iwlwifi: fix a memory corruption
CVE-2024-26614 7.8 HIGH tcp: make sure init the accept_queue's spinlocks once
CVE-2021-47068 7.8 HIGH net/nfc: fix use-after-free llcp_sock_bind/connect
CVE-2024-26611 7.5 HIGH xsk: fix usage of multi-buffer BPF helpers for ZC XDP
CVE-2021-47066 7.1 HIGH async_xor: increase src_offs when dropping destination page
CVE-2021-47055 7.1 HIGH mtd: require write permissions for locking and badblock ioctls
CVE-2023-52497 7.1 HIGH erofs: fix lz4 inplace decompression
CVE-2024-26612 netfs, fscache: Prevent Oops in fscache_put_cache()
CVE-2024-26619 riscv: Fix module loading free order
CVE-2021-47065 rtw88: Fix array overrun in rtw_get_tx_power_params()

Showing top 20 of 53 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-52478

No comments yet

Leave a comment