Improper error handling in Linux kernel usb

1) Improper error handling

EUVDB-ID: #VU93619

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52692

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the scarlett2_usb_set_config() function in sound/usb/mixer_scarlett_gen2.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/51d5697e1c0380d482c3eab002bfc8d0be177e99
http://git.kernel.org/stable/c/be96acd3eaa790d10a5b33e65267f52d02f6ad88
http://git.kernel.org/stable/c/996fde492ad9b9563ee483b363af40d7696a8467
http://git.kernel.org/stable/c/145c5aa51486171025ab47f35cff34bff8d0cea3
http://git.kernel.org/stable/c/ca459dfa7d4ed9098fcf13e410963be6ae9b6bf3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.