CVE-2023-53523

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: fix time stamp counter initialization

If the gs_usb device driver is unloaded (or unbound) before the

interface is shut down, the USB stack first calls the struct

usb_driver::disconnect and then the struct net_device_ops::ndo_stop

callback.

In gs_usb_disconnect() all pending bulk URBs are killed, i.e. no more

RX'ed CAN frames are send from the USB device to the host. Later in

gs_can_close() a reset control message is send to each CAN channel to

remove the controller from the CAN bus. In this race window the USB

device can still receive CAN frames from the bus and internally queue

them to be send to the host.

At least in the current version of the candlelight firmware, the queue

of received CAN frames is not emptied during the reset command. After

loading (or binding) the gs_usb driver, new URBs are submitted during

the struct net_device_ops::ndo_open callback and the candlelight

firmware starts sending

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References