CVE-2023-52781
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/05/2024
Last modified:
25/09/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
usb: config: fix iteration issue in &#39;usb_get_bos_descriptor()&#39;<br />
<br />
The BOS descriptor defines a root descriptor and is the base descriptor for<br />
accessing a family of related descriptors.<br />
<br />
Function &#39;usb_get_bos_descriptor()&#39; encounters an iteration issue when<br />
skipping the &#39;USB_DT_DEVICE_CAPABILITY&#39; descriptor type. This results in<br />
the same descriptor being read repeatedly.<br />
<br />
To address this issue, a &#39;goto&#39; statement is introduced to ensure that the<br />
pointer and the amount read is updated correctly. This ensures that the<br />
function iterates to the next descriptor instead of reading the same<br />
descriptor repeatedly.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 3.16.79 (including) | 3.17 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.4.194 (including) | 4.5 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.9.194 (including) | 4.10 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.14.146 (including) | 4.15 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.19.75 (including) | 4.20 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.2.17 (including) | 5.3 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.3.1 (including) | 5.10.203 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.142 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.66 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.4 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702
- https://git.kernel.org/stable/c/7c0244cc311a4038505b73682b7c8ceaa5c7a8c8
- https://git.kernel.org/stable/c/974bba5c118f4c2baf00de0356e3e4f7928b4cbc
- https://git.kernel.org/stable/c/9ef94ec8e52eaf7b9abc5b5f8f5b911751112223
- https://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91
- https://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702
- https://git.kernel.org/stable/c/7c0244cc311a4038505b73682b7c8ceaa5c7a8c8
- https://git.kernel.org/stable/c/974bba5c118f4c2baf00de0356e3e4f7928b4cbc
- https://git.kernel.org/stable/c/9ef94ec8e52eaf7b9abc5b5f8f5b911751112223
- https://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91



