PT-2025-40230 · Linux+2 · Linux Kernel+2
Published
2023-07-07
·
Updated
2026-03-13
·
CVE-2023-53523
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The gs usb device driver in the Linux kernel has an issue where the timestamp counter initialization can lead to a NULL pointer dereference. This occurs if the driver is unloaded or unbound before the interface is shut down, potentially causing issues with CAN frame processing. Specifically, if the gs usb device driver is unloaded before the interface is shut down, pending bulk URBs are killed, but the USB device may still receive CAN frames and queue them. When the driver is reloaded, these queued frames are sent to the host, and if the hardware timestamp function is called too early, a NULL pointer dereference can occur. The issue arises because the cycle counter/time counter infrastructure is set up after the USBs are submitted. The problem is exacerbated in devices with multiple channels, as the cycle counter is initially per-channel but URBs are per-device. The fix involves moving the timestamp initialization function before URB submission and converting the cycle counter to a per-device functionality.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linux Kernel
Suse