CVE-2023-25012
- State
- Published
- Severity
- 4.6 Medium
- Published
- Feb 1, 2023
- Updated
- May 5, 2025
- Reserved
- Feb 1, 2023
Description
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://seclists.org/oss-sec/2023/q1/53
- https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16%40diag.uniroma1.it/
- [oss-security] 20230202 Re: Linux Kernel: hid: Use-After-Free in bigben_set_led()mailing-list
- [debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security updatemailing-list
- [oss-security] 20231105 CVE-2023-1078: Linux: rds_rm_zerocopy_callback() bugsmailing-list
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76ca8da989c7d97a7f76c75d475fe95a584439d7
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27d2a2fd844ec7da70d19fabb482304fd1e0595b
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2
- https://bugzilla.suse.com/show_bug.cgi?id=1207560
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.