CVE-2023-52478 is a vulnerability in the Linux kernel's Logitech HID++ driver (logitech-hidpp), specifically affecting the handling of USB receiver disconnect events. The root cause is a time-of-check to time-of-use (TOCTOU) race condition in the function hidpp_connect_event(), which can be invoked concurrently from multiple threads: one running from probe() and others from a workqueue triggered by device-connected packets. This concurrency leads to four distinct race conditions, with the most critical involving the initialization and registration of the power_supply class device representing the battery. Due to the race, two power_supply devices may be registered for the same battery, sharing a descriptor structure whose properties pointer is overwritten by the second registration. Upon USB receiver disconnect, the kernel unregisters these devices sequentially, freeing the memory pointed to by the shared descriptor's properties pointer. However, the first unregistration still references this now-freed memory when sending a remove uevent to userspace, causing a use-after-free scenario. This results in kernel crashes and page faults, as evidenced by kernel backtraces involving power_supply_uevent(). The vulnerability arises from improper synchronization and shared resource management in the driver, leading to memory corruption and system instability. While the races involving protocol retrieval and device name updates are benign, the battery power_supply registration race is severe. The issue affects Linux kernel versions identified by the commit hash 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and has been publicly disclosed without known exploits in the wild. No CVSS score is assigned yet, and no official patch links are provided in the data, but the vulnerability is acknowledged and published by the Linux project.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with Logitech HID++ devices connected via USB receivers. The impact includes potential kernel crashes leading to denial of service (DoS) conditions, which can disrupt critical services and operations. In environments where Linux is used for servers, workstations, or embedded systems interfacing with Logitech peripherals, unexpected system instability could cause operational downtime, data loss, or interruptions in business processes. Although the vulnerability does not directly enable privilege escalation or remote code execution, the kernel crash and use-after-free could be leveraged in complex attack chains or targeted attacks against high-value assets. Organizations in sectors such as finance, healthcare, manufacturing, and government that rely on Linux infrastructure and Logitech hardware may experience increased risk. Additionally, the instability could complicate incident response and system reliability, especially in environments with limited physical access or automated recovery mechanisms. The lack of known exploits reduces immediate threat but does not eliminate the risk of future weaponization, making timely mitigation essential.

1. Update the Linux kernel to a version that includes the fix for CVE-2023-52478 as soon as it becomes available from trusted Linux distribution vendors or the upstream Linux kernel. Monitor vendor advisories for patches addressing this specific HID++ race condition. 2. As a temporary workaround, consider disconnecting Logitech USB receivers or avoiding the use of affected Logitech HID++ devices on critical systems until patches are applied. 3. Implement kernel crash monitoring and automated recovery mechanisms to minimize downtime if the vulnerability is triggered. 4. For environments with custom kernel builds, apply the relevant patches from the Linux kernel source tree that fix the TOCTOU races in hidpp_connect_event(), ensuring proper synchronization and resource management. 5. Conduct thorough testing of Logitech device interactions post-patch to confirm resolution and prevent regressions. 6. Employ strict USB device control policies to limit unauthorized or unnecessary USB device connections, reducing exposure. 7. Maintain up-to-date system backups and incident response plans to recover quickly from potential crashes or instability caused by this vulnerability.