Vulnerabilities > CVE-2023-25012 - Use After Free vulnerability in Linux Kernel
Attack vector
PHYSICAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://seclists.org/oss-sec/2023/q1/53
- http://www.openwall.com/lists/oss-security/2023/02/02/1
- https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
- http://www.openwall.com/lists/oss-security/2023/11/05/1
- https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16%40diag.uniroma1.it/
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76ca8da989c7d97a7f76c75d475fe95a584439d7
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27d2a2fd844ec7da70d19fabb482304fd1e0595b
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2
- https://bugzilla.suse.com/show_bug.cgi?id=1207560