CVE-2023-4010
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole that leads to an endless loop when a specific malformed descriptor file is input, resulting in a denial of service.
Risk Assessment
This vulnerability can lead to system lockup, affecting the availability of services within the organization. If exploited, it can cause significant disruptions to system operations.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability. Additionally, monitor systems for unauthorized attempts to exploit this vulnerability.
Original NVD description (English source)
A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service.