Uninitialized Memory Access in USB Storage Drivers Affects Linux Kernel

CVE-2023-53847

What is CVE-2023-53847?

This vulnerability involves an uninitialized memory access in the alauda subdriver within the USB storage drivers of the Linux kernel. Specifically, the function alauda_check_media() fails to validate the success of a USB transfer before utilizing the received data, potentially leading to unpredictable behavior. Further compounding the issue, similar concerns arise in the alauda_get_media_status() function where redundant debug messages could lead to confusion during error handling. Additionally, the function performs Direct Memory Access (DMA) to a stack-based buffer, which is unsafe; to mitigate this, the kernel now uses a general-purpose DMA-able buffer for safer operations.

References