Executive brief
The Linux kernel's HID (Human Interface Device) subsystem contains a data race condition in the hidraw device driver when multiple processes open the same device simultaneously. This race condition could lead to memory corruption, system crashes, or denial of service when users or applications attempt concurrent access to HID devices such as keyboards, mice, or other input peripherals.
Technical details
A data race exists in the hidraw_open() function where the device reference counter is incremented without proper synchronization. The vulnerability stems from a regression introduced by commit 8590222e4b02, which replaced a mutex with a read-write semaphore (minors_rwsem) but failed to protect the reference counter increment. The fix changes the hidraw_open() function to acquire a write lock (down_write) instead of a read lock (down_read) on minors_rwsem, ensuring exclusive access during reference counter modification. This matches the locking strategy in hidraw_release(). The race can be triggered by concurrent open() system calls on the same /dev/hidraw* device.
Affected products
- Linux Linux kernel Linux 4.14 and later (regression introduced in commit 8590222e4b02; fixed in 6.4 and backported to stable branches)
Timeline
- 2023-06-21: disclosed
- 2023-07-01: patched