PT-2024-14744 · Linux+7 · Linux Kernel+7

Niklas Neronin · Published 2023-11-15 · Updated 2025-09-29 · CVE-2023-52781

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an iteration problem in the usb get bos descriptor() function when skipping the USB DT DEVICE CAPABILITY descriptor type. This results in the same descriptor being read repeatedly. A goto statement is introduced to ensure the pointer and the amount read are updated correctly, allowing the function to iterate to the next descriptor instead of reading the same one repeatedly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-670

CWE-20

Related Identifiers

ALSA-2024:4211

ALSA-2024:4352

ALSA-2025_16880

BDU:2025-07716

CESA-2024_4211

CESA-2024_4352

CVE-2023-52781

INFSA-2024_4211

INFSA-2024_4352

OESA-2024-1894

OESA-2024-1896

OPENSUSE-SU-2024_2189-1

RHSA-2024:4211

RHSA-2024:4352

RHSA-2024_4211

RHSA-2024_4352

RHSA-2025:10701

RLSA-2024:4211

RLSA-2024:4352

RXSA-2024:4211

SUSE-SU-2024:1979-1

SUSE-SU-2024:1983-1

SUSE-SU-2024:2008-1

SUSE-SU-2024:2011-1

SUSE-SU-2024:2019-1

SUSE-SU-2024:2184-1

SUSE-SU-2024:2189-1

SUSE-SU-2024:2190-1

SUSE-SU-2024:2571-1

SUSE-SU-2024:2896-1

SUSE-SU-2024:2973-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

Affected Products

Almalinux

Astra Linux

Centos

Linux Kernel

Red Hat

Red Os

Rocky Linux

Suse

References · 2925

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52781.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2024:1983-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48844 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-40941 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-40968 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52781 · Vendor Advisory
• https://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702 · Patch
• https://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36031 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:2973-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40987 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-4211.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40929 · Security Note