CVE-2023-1079

What it actually does

Use-after-free in the asus_kbd_backlight_set function of the Linux kernel ASUS keyboard LED driver, where a work_struct scheduled by the LED controller can reference a freed asus_kbd_leds structure during malicious USB connect/disconnect, enabling controlled memory corruption.

Why it matters to the business

Linux systems supporting ASUS keyboard backlights face risk of kernel memory corruption and potential system instability or compromise when exposed to crafted USB hardware, increasing operational risk for devices using affected kernel versions.

How an attack unfolds

An attacker creates a USB device that emulates an ASUS keyboard, connects it to trigger backlight handling, then disconnects to cause the scheduled work to operate on a freed structure, resulting in memory corruption with attacker-controlled data.

How to fix it

Update the Linux kernel to include commit 457391b0380335d5e9a5babdec90ac53928b23b4 or any later version that patches the ASUS keyboard LED driver.

How to confirm the fix worked

Confirm the running kernel contains commit 457391b0380335d5e9a5babdec90ac53928b23b4 by inspecting git history or kernel build identifiers; review dmesg and USB event logs for absence of asus_kbd_leds related faults after applying the update.

Typical attack path

1. Craft a USB device that identifies as an ASUS keyboard with backlight support
2. Insert the device to invoke asus_kbd_backlight_set and schedule LED work
3. Remove the device while work is pending to trigger use-after-free on the led structure
4. Leverage resulting memory corruption for further exploitation or denial of service

How to detect it

Examine kernel logs (dmesg, syslog) for ASUS keyboard LED driver entries, workqueue faults, or use-after-free warnings around USB connect/disconnect events; review audit logs for unexpected ASUS-emulating USB device attachments.

What your security team should do

• Apply the referenced kernel commit or newer releases to all affected systems
• Restrict physical access to USB ports where feasible
• Monitor kernel logs for USB and LED driver anomalies during routine operations