CVE-2023-1073

What it actually does

Memory corruption in the Linux kernel HID subsystem triggered by a malicious USB device, enabling local denial of service via crash or potential privilege escalation to root.

Why it matters to the business

Systems running vulnerable Linux kernels face risk of local disruption or full compromise if an attacker gains brief physical access, though the flaw's age and low exploitation probability limit widespread operational impact across server and desktop fleets.

How an attack unfolds

An attacker with physical access inserts a crafted USB device that triggers improper handling in the kernel's HID code path, corrupting memory structures to either crash the system or elevate privileges from a local account.

How to fix it

Apply the latest upstream Linux kernel security updates or vendor backports for affected distributions such as Red Hat Enterprise Linux and Fedora; disable unnecessary USB HID support where feasible via kernel configuration or module blacklisting.

How to confirm the fix worked

Verify updated kernel versions are running via uname or package manager queries; review vendor security advisories for HID-related fixes and perform regression testing with known USB devices.

Typical attack path

1. Obtain brief physical access to the target Linux system
2. Insert a specially crafted USB HID device
3. Allow the kernel to process the device descriptor and trigger the memory corruption
4. Leverage the resulting corruption for crash or privilege escalation payload execution

How to detect it

Review system and kernel logs for HID subsystem errors or unexpected device enumeration around the time of suspected physical access; correlate with authentication or privilege change events.

What your security team should do

• Prioritize kernel updates on all exposed Linux endpoints despite low EPSS and absence from KEV
• Enforce physical security controls and USB port restrictions or device allow-listing
• Monitor kernel logs for HID-related oops or panic events as part of routine auditing