CVE-2023-54186

Vulnerability

Overview

A use-after-free vulnerability exists in pin_assignment_show within the Linux kernel's USB Type-C DisplayPort alternate mode driver. The bug occurs when get_current_pin_assignments returns 0 (i.e., no compatible pin assignments are found), leading to negative indexing of the buf array. This triggers a KASAN: use-after-free error, as demonstrated in the kernel crash trace [1].

Exploitation

The vulnerability is accessible locally through the sysfs attribute interface. An attacker with local access can trigger the bug by reading the pin_assignment sysfs file when no pin assignments are configured. No special privileges are required beyond the ability to access the sysfs entry for a USB Type-C DisplayPort device [2].

Impact

Successful exploitation results in a use-after-free condition, potentially allowing an attacker to escalate privileges or cause a denial of service. The KASAN report indicates memory corruption that could be leveraged for arbitrary code execution in kernel context [3].

Mitigation

Patches have been applied to the Linux kernel stable branches. Users should update to a kernel version containing the fix, such as commits [1], [2], and [3]. No workarounds are available; updating is the recommended course of action.