Vulnerability identifier: #VU96346

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52898

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xhci_free_dev() function in drivers/usb/host/xhci.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1
http://git.kernel.org/stable/c/133b902378e4acbd824c29dd0d48570ad596e368
http://git.kernel.org/stable/c/081105213ff6f661c114781d469233c7d0e09c2e
http://git.kernel.org/stable/c/c462ac871f49753eca86bb960f573b993976a5ea
http://git.kernel.org/stable/c/ea2ee5e9991caf74e0604f994c1831a5867055b2
http://git.kernel.org/stable/c/a2bc47c43e70cf904b1af49f76d572326c08bca7

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.