CVE-2023-52445

What it actually does

A use-after-free occurs in the pvrusb2 driver when the context kthread calls pvr2_context_destroy and kfree before the usb hub_event handler can safely access the object, enabling invalid memory reads or writes.

Why it matters to the business

Local attackers could gain elevated privileges, execute arbitrary code, or crash systems on affected Linux kernels, risking service disruption or data exposure in environments using the pvrusb2 USB device driver; the issue has remained unexploited in the wild for over two years with very low exploitation probability.

How an attack unfolds

An attacker with local access loads the pvrusb2 module, forces a context thread to destroy and free the object, then triggers the USB hub_event handler to perform an invalid access on the freed memory, which can be turned into code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit ec36c134dd020d28e312c2f1766f85525e747aab; unload or blacklist the pvrusb2 module when the hardware is not required.

How to confirm the fix worked

Confirm the running kernel contains commit ec36c134dd020d28e312c2f1766f85525e747aab; inspect source for the added sanity check before context access in the disconnection path; test USB attach/detach cycles under load.

Typical attack path

1. Load the vulnerable pvrusb2 kernel module
2. Create and disconnect a pvrusb2 context via USB device events
3. Trigger the kthread destruction path to free the context object
4. Have the hub_event handler perform a read or write on the now-freed memory
5. Leverage the use-after-free for privilege escalation or system crash

How to detect it

Review kernel ring buffer and dmesg for pvrusb2 context or kthread errors around USB hotplug events; correlate module load times with subsequent crashes or oops reports.

What your security team should do

• Apply the referenced kernel commit or newer stable release as soon as possible
• Disable the pvrusb2 driver via modprobe blacklist if the hardware is absent
• Monitor kernel logs for pvrusb2-related oops or use-after-free warnings
• Restrict unprivileged USB device attachment on multi-user systems