CVE-2023-4134

What it actually does

Race condition in cyttsp4_core driver due to use of del_timer_sync() instead of timer_shutdown_sync() allowing use-after-free on timer object.

Why it matters to the business

Affected Linux systems risk kernel instability, crashes, or local privilege escalation; low exploit probability but high impact on device security where the driver is present.

How an attack unfolds

Local attacker triggers concurrent timer operations in the cyttsp4 touchscreen driver to free the timer while it is still active, leading to use-after-free for code execution or denial of service.

How to fix it

Apply kernel patch containing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c which replaces del_timer_sync() with timer_shutdown_sync() in cyttsp4_core; rebuild and deploy updated kernel.

How to confirm the fix worked

Inspect kernel source for the timer_shutdown_sync() change or confirm git commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c is present in the tree; test driver load/unload under concurrency.

Typical attack path

1. Locate system running vulnerable Linux kernel with cyttsp4_core enabled
2. Craft input or workload to race timer shutdown
3. Trigger use-after-free to corrupt kernel memory
4. Escalate to kernel code execution or system crash

How to detect it

Review kernel logs for oops or use-after-free warnings referencing cyttsp4 or timer code; correlate with processes accessing input devices.

What your security team should do

• Prioritize kernel upgrade on any systems exposing the cyttsp4 driver
• Disable unnecessary touchscreen drivers if not required
• Monitor kernel update channels for backports