CVE-2023-37453

What it actually does

Out-of-bounds memory access in read_descriptors within the USB core sysfs handler causes kernel crash or memory corruption when processing malformed USB device descriptors.

Why it matters to the business

Local denial-of-service on Linux systems exposed to untrusted USB hardware, leading to unplanned reboots or service interruption until patched kernels are deployed across fleets.

How an attack unfolds

An attacker with physical access attaches a crafted USB device whose descriptors trigger the bounds check failure in the kernel's sysfs USB interface, resulting in an immediate kernel oops and system crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 1e4c574225cc5a0553115e5eb5787d1474db5b0f or later; rebuild and reboot affected hosts with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 1e4c574225cc5a0553115e5eb5787d1474db5b0f; attempt to enumerate USB descriptors via sysfs on test hardware and verify absence of kernel oops or crashes.

Typical attack path

1. Obtain physical access to a target Linux system
2. Connect a USB device engineered to supply oversized or malformed descriptors
3. Trigger the sysfs read path that invokes read_descriptors
4. Cause out-of-bounds access resulting in kernel panic

How to detect it

Review kernel logs for oops or panic entries referencing read_descriptors or drivers/usb/core/sysfs.c around the time of unexpected reboots; correlate with USB device insertion events in udev or syslog.

• read_descriptors
• drivers/usb/core/sysfs.c
• usb device descriptor oops
• kernel panic usb sysfs

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-user Linux systems within the next maintenance window
• Restrict physical USB port access via BIOS or hardware policies until patches are applied
• Monitor EPSS and exploit availability trends for any increase in public tooling