CVE-2023-1079 is a use-after-free vulnerability in the Linux kernel's asus_kbd_backlight_set function, affecting Linux kernel versions. This flaw can be triggered by a malicious USB device advertising itself as an Asus device, leading to memory corruption with controlled data. With a CVSS score of 6.8 (Medium), it requires physical access (AV:P) but has low attack complexity (AC:L), potentially resulting in high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-1079
Apr 11, 2023A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012 but in asus devices the work_struct may be scheduled by the LED controller while the device is disconnecting triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
Mar 14, 2023kernel: hid: Use After Free in asus_remove()
Feb 12, 2023