CVE-2023-52765

mfd: qcom-spmi-pmic: Fix revid implementation

Medium · published May 21, 2024

CVSS v3.1
6.2
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mfd: qcom-spmi-pmic: Fix revid implementation

The Qualcomm SPMI PMIC revid implementation is broken in multiple ways.

First, it assumes that just because the sibling base device has been

registered that means that it is also bound to a driver, which may not

be the case (e.g. due to probe deferral or asynchronous probe). This

could trigger a NULL-pointer dereference when attempting to access the

driver data of the unbound device.

Second, it accesses driver data of a sibling device directly and without

any locking, which means that the driver data may be freed while it is

being accessed (e.g. on driver unbind).

Third, it leaks a struct device reference to the sibling device which is

looked up using the spmi_device_from_of() every time a function (child)

device is calling the revid function (e.g. on probe).

Fix this mess by reimplementing the revid lookup so that it is done only

at probe of the PMIC device; the base device fetches the revid info from

the hardware, while any secondary SPMI device fetches the information

from the base device and caches it so that it can be accessed safely

from its children. If the base device has not been probed yet then probe

of a secondary device is deferred.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.7th percentile
Published
2024-05-21T15:30Z
EPSS history
Timeline
  • 21 MAY 15:30Z
    mfd: qcom-spmi-pmic: Fix revid implementation
    cvelistv5