CVE-2023-52907

What it actually does

Use-after-free in USB gadget dummy_hcd when pn533_usb_send_frame completes in_urb before out_urb, allowing freed skb data to be accessed as a transfer buffer during dummy_timer processing.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems with pn533 USB NFC hardware, increasing risk of denial of service and potential local privilege escalation in affected environments.

How an attack unfolds

An attacker triggers pn533_usb_send_frame with crafted USB frames to create a race where in_urb completion frees skb data before out_urb finishes, leading to use-after-free in the dummy_hcd timer path.

How to fix it

Update Linux kernel to commit 35529d6b827eedb6bf7e81130e4b7e0aba9e58d2 or later stable versions that separate out_urb and ack_urb completion handlers and add the required wait.

How to confirm the fix worked

Verify kernel source contains the pn533 out_urb/in_urb ordering fix, rebuild, boot on affected hardware, and confirm absence of KASAN reports under USB transfer load.

Typical attack path

1. Attach or emulate pn533 USB device
2. Invoke pn533_usb_send_frame under timing conditions
3. Force earlier in_urb completion via pn533_send_async_complete
4. Trigger dummy_timer to access freed buffer

How to detect it

Search kernel logs for KASAN use-after-free reports mentioning dummy_timer, dummy_perform_transfer, or pn533_usb_send_frame; inspect USB gadget traces around timer expiration.

• BUG: KASAN: use-after-free in dummy_timer
• dummy_perform_transfer (drivers/usb/gadget/udc/dummy_hcd.c:1352)
• dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:1972)
• pn533_usb_send_frame
• pn533_send_async_complete

What your security team should do

• Apply the referenced kernel commit immediately on all systems exposing pn533 USB
• Disable pn533 USB support where NFC is not required
• Monitor for USB gadget or NFC-related kernel oops
• Re-test with fuzzing tools after patching