CVE-2023-52655

What it actually does

Improper input validation in the aqc111 USB driver allows a packet length between 0 and sizeof(u64) to wrap around when passed to skb_trim, resulting in the driver parsing a header at an invalid large offset and triggering an oops or processing attacker-controlled random data.

Why it matters to the business

Systems using the affected Linux kernel USB driver face risk of kernel crashes or memory corruption from specially crafted USB devices, potentially leading to denial of service or privilege escalation on affected hosts; the issue has low public exploit activity and no known ransomware use.

How an attack unfolds

An attacker with physical or logical access to connect a malicious USB device sends a crafted packet whose length is between 0 and 8 bytes; the missing upper-bound check causes skb_trim to receive a wrapped-around length, after which the driver dereferences an invalid header location.

How to fix it

Update the Linux kernel to a version containing commit 84f2e5b3e70f08fce3cb1ff73414631c5e490204 or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 84f2e5b3e70f08fce3cb1ff73414631c5e490204 via git log or version string; test with a USB device emulator sending packets sized 1-7 bytes and verify no oops or wrap-around occurs.

Typical attack path

1. Attacker prepares a USB device or emulator capable of sending a packet with length in (0, sizeof(u64)).
2. Device is connected to a vulnerable Linux host using the aqc111 driver.
3. Driver receives the packet and performs the unchecked length calculation leading to wrap-around in skb_trim.
4. Subsequent header parsing at the resulting large offset causes kernel oops or processes uncontrolled data.

How to detect it

Monitor kernel logs for oops or panic messages referencing aqc111 or skb_trim; examine dmesg and syslog for USB packet processing errors on hosts with the driver loaded.

What your security team should do

• Prioritize kernel updates on all systems exposing the aqc111 driver to untrusted USB devices.
• Apply the fix commit and verify via kernel build logs before production deployment.
• Restrict physical USB access on high-value hosts until patches are applied.