CVE-2023-22999

What it actually does

The dwc3_qcom_create_urs_usb_platdev function returns an error pointer on failure instead of NULL, but the caller in drivers/usb/dwc3/dwc3-qcom.c checks only for NULL, causing dereference of an invalid pointer and potential memory corruption or kernel panic in the Qualcomm USB driver.

Why it matters to the business

Affected Linux systems with Qualcomm USB hardware may experience unexpected crashes or denial of service, leading to operational downtime and requiring kernel updates to restore stability.

How an attack unfolds

A local attacker with low privileges triggers USB controller initialization on vulnerable hardware, forcing the error return path in dwc3-qcom.c; the misinterpretation of the error pointer leads to invalid memory access and system instability.

How to fix it

Update the Linux kernel to version 5.16.3 or newer by applying commit b52fe2dbb3e655eb1483000adfab68a219549e13 to drivers/usb/dwc3/dwc3-qcom.c.

How to confirm the fix worked

Confirm the running kernel version is 5.16.3 or later and verify the fix commit is present in the dwc3-qcom.c source.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger USB device or controller initialization involving dwc3-qcom
3. Cause the error path to execute and mishandle the returned pointer
4. Induce kernel panic or memory corruption

How to detect it

Review kernel logs and dmesg output for oops or panic messages referencing dwc3-qcom.c or invalid pointer dereferences during USB initialization; no known in-the-wild exploitation exists.

What your security team should do

• Apply the kernel update to all affected systems as soon as possible
• Test the patched kernel in non-production environments first
• Monitor kernel logs for USB-related crashes during rollout