CVE-2023-54207

What it actually does

Use-after-free in kernel HID uclogic driver caused by devm allocation of input_dev name string referencing the input device instead of the HID device; the name is freed by devres before a uevent that still references it fires on input_dev unregistration.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or potentially escalate privileges, leading to system instability or compromise on devices using uclogic-based input hardware.

How an attack unfolds

An attacker with local access loads or unloads the uclogic HID driver or triggers input device registration/unregistration sequences; the freed name buffer is then dereferenced during uevent processing, enabling memory corruption that can be leveraged for code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit f283805d984343b2f216e2f4c6c7af265b9542ae or later; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel source contains commit f283805d984343b2f216e2f4c6c7af265b9542ae, or confirm the devm allocation now uses the HID device parent and devm_kasprintf for the input_dev name.

Typical attack path

1. Obtain local access on target Linux system
2. Trigger HID device attach/detach or module load/unload for uclogic
3. Cause input_dev unregistration while uevent processing references the now-freed name string
4. Exploit resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings, slab corruption messages, or oops traces involving hidinput, uclogic, or uevent name handling around device registration events.

What your security team should do

• Immediately apply the referenced kernel commit or distribution update to all systems
• Prioritize systems with uclogic HID hardware or custom input device configurations
• Monitor for kernel oops or panic logs related to input or HID uevents
• Harden local access controls until patches are deployed