CVE-2023-1118

What it actually does

Use-after-free condition in the Linux kernel's integrated infrared receiver/transceiver driver triggered during rc device detachment, enabling local memory corruption that can lead to kernel crash or privilege escalation.

Why it matters to the business

Linux systems with infrared hardware face risk of denial-of-service crashes or local attackers gaining elevated privileges; low EPSS and no KEV or ransomware usage keep overall exposure limited despite 1324 days since publication.

How an attack unfolds

A local attacker with access to an affected Linux kernel attaches and then detaches an rc device in a manner that leaves dangling references in the infrared driver, allowing subsequent use of freed memory to corrupt kernel structures and escalate privileges; no named threat actors or campaigns are associated.

How to fix it

Upgrade the Linux kernel to a version containing commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17; apply the fix across all torvalds/linux GIT-based distributions and rebuild or reboot as required.

How to confirm the fix worked

Confirm kernel source contains commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 or verify running kernel version includes the corresponding backport; test rc device attach/detach operations under load to ensure no crashes occur.

Typical attack path

1. Gain local shell access on target Linux system
2. Interact with infrared rc device via /dev or sysfs interfaces
3. Trigger device detachment sequence that induces use-after-free
4. Exploit resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs for oops or panic messages referencing the infrared or rc driver during device detachment events; examine audit logs for unusual local user interactions with infrared sysfs or character devices.

What your security team should do

• Prioritize kernel upgrades containing the referenced commit on all systems exposing infrared hardware
• Monitor for local privilege-escalation attempts on Linux endpoints until patches are deployed
• Restrict local user access to infrared device interfaces where operationally feasible