CVE-2023-52477

What it actually does

Null pointer dereference crash in hub_port_reset and related USB hub functions when udev->bos is uninitialized after usb_get_bos_descriptor failure, leading to kernel oops and denial of service.

Why it matters to the business

Unexpected system crashes and reboots on Linux hosts when certain USB devices are attached or during hub events, causing operational downtime and potential loss of in-progress work.

How an attack unfolds

An attacker with local physical or privileged access connects a USB device that triggers failure in BOS descriptor retrieval; subsequent hub event processing dereferences the NULL bos pointer, crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit c64e4dca9aefd232b17ac4c779b608b286654e81 or later stable releases that guard BOS descriptor accesses and fall back to default behavior when the descriptor is unavailable.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; test by attaching USB devices known to exercise BOS paths and verify absence of NULL pointer oops in dmesg; review hub.c code for explicit bos != NULL checks before field access.

Typical attack path

1. Obtain local access to a Linux system (physical USB port or sufficient privileges)
2. Attach or trigger a USB device that causes usb_get_bos_descriptor to fail
3. Allow usb_hub_wq to invoke hub_event and hub_port_reset
4. Trigger NULL dereference at udev->bos field access resulting in kernel panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for BUG: kernel NULL pointer dereference combined with hub_port_reset, hub_event, and usb_hub_wq stack traces; correlate with USB device insertion events preceding the crash.

• BUG: kernel NULL pointer dereference.*hub_port_reset
• Workqueue: usb_hub_wq hub_event
• hub_port_reset+0x193/0x788

What your security team should do

• Prioritize kernel updates on all Linux systems that handle USB devices, especially servers and workstations exposed to untrusted peripherals
• Monitor for kernel oops and panic events related to USB hub processing
• Apply defense-in-depth by restricting unprivileged USB device attachment where feasible