CVE-2023-28328

What it actually does

A NULL pointer dereference in the az6027 USB driver occurs when a user-space message is not validated before transfer to the device, allowing a local user to trigger a kernel panic or denial of service.

Why it matters to the business

Local denial-of-service conditions can crash affected Linux systems, causing unplanned downtime and operational disruption on devices using the vulnerable driver; the issue has been public for over three years with no observed exploitation trend.

How an attack unfolds

An attacker with local access on a system using the az6027 driver sends a specially crafted, unchecked message from user space into the driver code path in az6027.c, triggering the NULL pointer dereference and resulting in an immediate kernel crash.

How to fix it

Update the affected Linux kernel to a patched version that properly validates messages in the az6027 driver; for wp-erp/wp-erp (GIT) deployments, apply the fix present in commit d5c495ae1b2d79b71f66050d929f66bbcbc116d8.

How to confirm the fix worked

Confirm the driver source no longer performs unchecked message transfers before device interaction; test by attempting message submission from a local unprivileged account and verify absence of kernel oops or panic.

Typical attack path

1. Gain local shell or user access on the target Linux system
2. Confirm presence of the az6027 USB driver
3. Craft and transmit an invalid user-space message to the device interface
4. Trigger the NULL pointer dereference resulting in kernel panic and system crash

How to detect it

Inspect kernel logs and dmesg output for az6027 driver entries, NULL pointer dereference oops messages, or sudden panics coinciding with USB device activity; correlate with local user processes interacting with /dev entries for the driver.

• az6027
• NULL pointer dereference
• drivers/media/usb/dev-usb/az6027.c

What your security team should do

• Prioritize kernel updates on all systems exposing the az6027 driver
• Restrict local user access where the vulnerable driver may be present
• Monitor kernel logs for az6027-related panics as an indicator of attempted exploitation
• Review and apply the referenced commit across all relevant codebases