CVE-2023-52475

What it actually does

Use-after-free in the powermate USB driver where device disconnection frees the powermate_device struct while a pending asynchronous control URB completion callback still references it, causing invalid memory access after kfree.

Why it matters to the business

Local attackers can trigger crashes or arbitrary code execution on Linux systems exposing the Griffin PowerMate driver, leading to denial of service, privilege escalation, or system compromise for affected hosts.

How an attack unfolds

An attacker with local access connects a powermate device, initiates disconnection to trigger kfree of the device struct, then allows the in-flight USB control message callback to execute on the now-freed memory without the lock or valid object.

How to fix it

Upgrade the Linux kernel to a version containing commit 8677575c4f39d65bf0d719b5d20e8042e550ccb9, which calls usb_kill_urb() on pm->config during disconnection to cancel pending requests.

How to confirm the fix worked

Confirm the fix commit is present in the kernel tree or source; test by simulating device disconnect with pending async URBs and verify no use-after-free reports in kernel logs or syzkaller reproducers.

Typical attack path

1. Attach compatible USB input device
2. Trigger device removal or unplug while config URB is pending
3. Invoke powermate_config_complete callback on freed struct
4. Achieve use-after-free for crash or code execution

How to detect it

Search kernel logs and crash dumps for use-after-free reports referencing powermate_config_complete, powermate_device, or usb control message callbacks during device disconnect events.

What your security team should do

• Immediately update to a kernel containing commit 8677575c4f39d65bf0d719b5d20e8042e550ccb9
• Disable the powermate driver module if the hardware is not required
• Monitor kernel logs and crash reports for powermate-related use-after-free signatures