CVE-2023-52853 – This vulnerability in the Linux kernel's cp2112... (How to Fix)

Q: What is the severity of CVE-2023-52853?

CVE-2023-52853 has a CVSS score of 5.5 (MEDIUM). This vulnerability in the Linux kernel's cp2112 HID driver involves duplicate workqueue initialization during IRQ startup, which can trigger a kernel warning and potentially cause a NULL pointer dereference. It affects systems using the cp2112 driver for HID devices. The issue requires local access to trigger but could lead to system instability.

📋 TL;DR

This vulnerability in the Linux kernel's cp2112 HID driver involves duplicate workqueue initialization during IRQ startup, which can trigger a kernel warning and potentially cause a NULL pointer dereference. It affects systems using the cp2112 driver for HID devices. The issue requires local access to trigger but could lead to system instability.

💻 Affected Systems

Products:

Linux kernel with cp2112 HID driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with cp2112 HID devices connected and using GPIO interrupt functionality.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to NULL pointer dereference in the workqueue subsystem, leading to denial of service.

🟠

Likely Case

Kernel warning messages in system logs and potential system instability or crashes when cp2112 GPIO IRQs are repeatedly started.

🟢

If Mitigated

Minor system logging of warnings without significant impact if the system isn't heavily using cp2112 GPIO interrupts.

🌐 Internet-Facing: LOW - Requires local access to trigger via cp2112 device interaction.

🏢 Internal Only: MEDIUM - Local users or processes with cp2112 device access could cause system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and specific cp2112 device interaction to trigger duplicate workqueue initialization.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 012d0c66f9392a99232ac28217229f32dd3a70cf, 3d959406c8fff2334d83d0c352d54fd6f5b2e7cd, 727203e6e7e7020e1246fc1628cbdb8d90177819, bafb12b629b7c3ad59812dd1ac1b0618062e0e38, df0daac2709473531d6a3472997cc65301ac06d6

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable cp2112 driver

linux

Prevent loading of the vulnerable cp2112 driver module

echo 'blacklist hid_cp2112' >> /etc/modprobe.d/blacklist-cp2112.conf
rmmod hid_cp2112

Avoid GPIO IRQ usage

linux

Prevent triggering the vulnerability by avoiding cp2112 GPIO interrupt functionality

🧯 If You Can't Patch

Disconnect cp2112 HID devices from the system
Restrict local user access to systems with cp2112 devices

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if cp2112 module is loaded: lsmod | grep cp2112 && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and check dmesg for absence of workqueue warnings related to cp2112

📡 Detection & Monitoring

Log Indicators:

Kernel warnings about set_work_data in workqueue.c
NULL pointer dereference errors in kernel logs
cp2112 driver error messages

SIEM Query:

source="kernel" AND ("set_work_data" OR "cp2112" OR "workqueue.c")

📊 Metadata

CVE ID: CVE-2023-52853

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 21, 2024

Last Updated: September 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-52853, you might also want to check these: