Memory Leak Vulnerability in Linux Kernel: USB Gadget bcm63xx_udc
Summary
CVE-2023-53412: In the Linux kernel, the following vulnerability has been resolved: USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the system, including device drivers, file systems, and system calls. The bcm63xx_udc is a USB gadget driver that allows devices to communicate over USB. This driver is crucial for devices that require USB connectivity, and vulnerabilities in this area can lead to significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2023-53412 pertains to a memory leak in the bcm63xx_udc USB gadget driver within the Linux kernel. The issue arises when the debugfs_lookup() function is called without a corresponding dput() call, leading to memory not being freed properly. Over time, this can result in increased memory consumption, potentially leading to system instability or crashes. The vulnerability has been resolved by recommending the use of debugfs_lookup_and_remove(), which correctly manages memory by handling both lookup and removal in one function call.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability other than applying the patch. It is recommended to keep the system updated to avoid potential risks associated with this memory leak.
Conclusion
In summary, CVE-2023-53412 is a memory leak vulnerability in the Linux kernel's USB gadget driver that can lead to significant system issues if not addressed. Users are advised to update their systems to the latest patched version to ensure security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53412 is a vulnerability in the Linux kernel's USB gadget driver bcm63xx_udc that causes a memory leak.
If exploited, this vulnerability can lead to increased memory usage, potentially causing system instability or crashes.
Yes, a patch is available in version 6.1.20-1 and later of the Linux package.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software without needing to access the code.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
