CVE-2023-52840

What it actually does

Use-after-free in rmi_unregister_function() where put_device() invokes rmi_release_function() to free the fn structure, followed by an immediate dereference of fn->num_of_irqs.

Why it matters to the business

Local attackers can trigger kernel crashes, memory corruption, or potential code execution on systems using the synaptics-rmi4 driver, leading to denial of service or privilege escalation on affected Linux kernels.

How an attack unfolds

An attacker with local access triggers the input device unregistration path in the synaptics-rmi4 driver, causing the use-after-free during function cleanup to corrupt kernel memory and potentially hijack execution.

How to fix it

Update the Linux kernel to a version containing commit 2f236d8638f5b43e0c72919a6a27fe286c32053f or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 2f236d8638f5b43e0c72919a6a27fe286c32053f via git log or kernel version string; attempt to exercise rmi_unregister_function paths in a test environment and verify no use-after-free reports in dmesg or KASAN output.

Typical attack path

1. Obtain local access to a system with the synaptics-rmi4 driver loaded
2. Trigger rmi_unregister_function via device removal or input subsystem events
3. Exploit the freed fn structure dereference to corrupt kernel memory
4. Escalate to arbitrary code execution or cause kernel panic

How to detect it

Review kernel logs for use-after-free warnings or KASAN reports referencing rmi_unregister_function or rmi_release_function; inspect dmesg and audit logs around device unregistration events.

What your security team should do

• Prioritize kernel updates on all systems exposing the synaptics-rmi4 driver
• Apply the fix commit 2f236d8638f5b43e0c72919a6a27fe286c32053f and test input device registration/unregistration
• Monitor for local privilege escalation attempts on endpoints running vulnerable kernels
• Restrict local user access where possible until patches are deployed