CVE-2023-52475
published 2024-02-29CVE-2023-52475: In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
Input: powermate - fix use-after-free in powermate_config_complete
syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct. When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.
Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.
[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8677575c4f39d65bf0d719b5d20e8042e550ccb9 | 8677575c4f39d65bf0d719b5d20e8042e550ccb9 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 67cace72606baf1758fd60feb358f4c6be92e1cc | 67cace72606baf1758fd60feb358f4c6be92e1cc |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5aa514100aaf59868d745196258269a16737c7bd | 5aa514100aaf59868d745196258269a16737c7bd |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cd2fbfd8b922b7fdd50732e47d797754ab59cb06 | cd2fbfd8b922b7fdd50732e47d797754ab59cb06 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6a4a396386404e62fb59bc3bde48871a64a82b4f | 6a4a396386404e62fb59bc3bde48871a64a82b4f |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2efe67c581a2a6122b328d4bb6f21b3f36f40d46 | 2efe67c581a2a6122b328d4bb6f21b3f36f40d46 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e528b1b9d60743e0b26224e3fe7aa74c24b8b2f8 | e528b1b9d60743e0b26224e3fe7aa74c24b8b2f8 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5c15c60e7be615f05a45cd905093a54b11f461bc | 5c15c60e7be615f05a45cd905093a54b11f461bc |
| linux | linux_kernel | < 4.14.328 | 4.14.328 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 4.15 < 4.19.297 | 4.19.297 |
| linux | linux_kernel | >= 4.20 < 5.4.259 | 5.4.259 |
| linux | linux_kernel | >= 5.11 < 5.15.136 | 5.15.136 |
| linux | linux_kernel | >= 5.16 < 6.1.59 | 6.1.59 |
| linux | linux_kernel | >= 5.5 < 5.10.199 | 5.10.199 |
| linux | linux_kernel | >= 6.2 < 6.5.8 | 6.5.8 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: use-after-free in powermate_config_complete
vendor_redhat·2024-02-29·CVSS 7.8
CVE-2023-52475 [HIGH] CWE-416 kernel: use-after-free in powermate_config_complete
kernel: use-after-free in powermate_config_complete
In the Linux kernel, the following vulnerability has been resolved:
Input: powermate - fix use-after-free in powermate_config_complete
syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct. When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.
Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.
[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
A use-after-free flaw was found in powermate_config_complete in drivers/input/misc/powermate.c in the Linux kernel. This issue may a
Debian
CVE-2023-52475: linux - In the Linux kernel, the following vulnerability has been resolved: Input: powe...
vendor_debian·2023·CVSS 7.8
CVE-2023-52475 [HIGH] CVE-2023-52475: linux - In the Linux kernel, the following vulnerability has been resolved: Input: powe...
In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
Scope: local
bookworm: resolved (fixed in 6.1.64-1)
bullseye: resolved (fixed in 5.10.205-1)
forky: resolved (fixed in 6.5.8-1)
sid: resolved (fixed in 6.5.8-1)
trixie: resolved (fixed i
OSV
CVE-2023-52475: In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has foun
osv·2024-02-29·CVSS 7.8
CVE-2023-52475 [HIGH] CVE-2023-52475: In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has foun
In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
GHSA
GHSA-jr9w-q6f5-5c6c: In the Linux kernel, the following vulnerability has been resolved:
Input: powermate - fix use-after-free in powermate_config_complete
syzbot has fo
ghsa_unreviewed·2024-02-29
CVE-2023-52475 [HIGH] CWE-416 GHSA-jr9w-q6f5-5c6c: In the Linux kernel, the following vulnerability has been resolved:
Input: powermate - fix use-after-free in powermate_config_complete
syzbot has fo
In the Linux kernel, the following vulnerability has been resolved:
Input: powermate - fix use-after-free in powermate_config_complete
syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct. When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.
Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.
[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2efe67c581a2a6122b328d4bb6f21b3f36f40d46https://git.kernel.org/stable/c/5aa514100aaf59868d745196258269a16737c7bdhttps://git.kernel.org/stable/c/5c15c60e7be615f05a45cd905093a54b11f461bchttps://git.kernel.org/stable/c/67cace72606baf1758fd60feb358f4c6be92e1cchttps://git.kernel.org/stable/c/6a4a396386404e62fb59bc3bde48871a64a82b4fhttps://git.kernel.org/stable/c/8677575c4f39d65bf0d719b5d20e8042e550ccb9https://git.kernel.org/stable/c/cd2fbfd8b922b7fdd50732e47d797754ab59cb06https://git.kernel.org/stable/c/e528b1b9d60743e0b26224e3fe7aa74c24b8b2f8https://git.kernel.org/stable/c/2efe67c581a2a6122b328d4bb6f21b3f36f40d46https://git.kernel.org/stable/c/5aa514100aaf59868d745196258269a16737c7bdhttps://git.kernel.org/stable/c/5c15c60e7be615f05a45cd905093a54b11f461bchttps://git.kernel.org/stable/c/67cace72606baf1758fd60feb358f4c6be92e1cchttps://git.kernel.org/stable/c/6a4a396386404e62fb59bc3bde48871a64a82b4fhttps://git.kernel.org/stable/c/8677575c4f39d65bf0d719b5d20e8042e550ccb9https://git.kernel.org/stable/c/cd2fbfd8b922b7fdd50732e47d797754ab59cb06https://git.kernel.org/stable/c/e528b1b9d60743e0b26224e3fe7aa74c24b8b2f8
2024-02-29
Published