CVE-2023-53759

Vulnerability

In the Linux kernel, the hidraw_open() function increments the hidraw device reference counter without proper synchronization, resulting in a data race when multiple processes concurrently open a hidraw device. The race was introduced by commit 8590222e4b02, which replaced a mutex with a rwsem but failed to protect the refcount. [1]

Exploitation

An unprivileged local attacker can exploit this race by opening the same hidraw device multiple times simultaneously, causing the refcount to be incremented incorrectly. This can lead to the device being freed while still in use (use-after-free). [1]

Impact

Successful exploitation could result in a use-after-free condition, potentially allowing an attacker to gain elevated privileges or cause a denial of service. The vulnerability is local and requires access to a hidraw device. [1]

Mitigation

The fix is included in Linux kernel stable releases. The commit 879e79c3aead addresses the race by acquiring the rwsem for writing in hidraw_open(), mirroring the protection in hidraw_release(). Users should update their kernel to a patched version. [1]