Linux Kernel USB Gadget Function HID Device Use-After-Free Vulnerability

A vulnerability in the Linux kernel's USB gadget function for HID devices can lead to a use-after-free issue. When the device is unbound and then re-bound, the character device is reinitialized, potentially while there are still active references to it. This can occur if the /dev/hidg* device is open, creating an unsafe situation that could lead to a crash. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability can cause a use-after-free condition, leading to a potential crash or memory corruption.

Reproduction

The vulnerability can be reproduced by opening a /dev/hidg* device, then unbinding and rebinding the corresponding USB gadget function. This sequence of actions will trigger the unsafe behavior, as the character device is reinitialized while still in use.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.