CVE-2023-52478

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU)

races when it races with itself.

hidpp_connect_event() primarily runs from a workqueue but it also runs

on probe() and if a "device-connected" packet is received by the hw

when the thread running hidpp_connect_event() from probe() is waiting on

the hw, then a second thread running hidpp_connect_event() will be

started from the workqueue.

This opens the following races (note the below code is simplified):

1. Retrieving + printing the protocol (harmless race):

if (!hidpp->protocol_major) {

hidpp_root_get_protocol_version()

hidpp->protocol_major = response.rap.params[0];

}

We can actually see this race hit in the dmesg in the abrt output

attached to rhbz#2227968:

[ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.

[ 3064.658184] logitech-hid

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References