fkie_cve-2023-52765
Vulnerability from fkie_nvd
Published
2024-05-21 16:15
Modified
2025-04-02 15:03
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mfd: qcom-spmi-pmic: Fix revid implementation The Qualcomm SPMI PMIC revid implementation is broken in multiple ways. First, it assumes that just because the sibling base device has been registered that means that it is also bound to a driver, which may not be the case (e.g. due to probe deferral or asynchronous probe). This could trigger a NULL-pointer dereference when attempting to access the driver data of the unbound device. Second, it accesses driver data of a sibling device directly and without any locking, which means that the driver data may be freed while it is being accessed (e.g. on driver unbind). Third, it leaks a struct device reference to the sibling device which is looked up using the spmi_device_from_of() every time a function (child) device is calling the revid function (e.g. on probe). Fix this mess by reimplementing the revid lookup so that it is done only at probe of the PMIC device; the base device fetches the revid info from the hardware, while any secondary SPMI device fetches the information from the base device and caches it so that it can be accessed safely from its children. If the base device has not been probed yet then probe of a secondary device is deferred.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4ce77b023d42a9f1062eecf438df1af4b4072eb2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7b439aaa62fee474a0d84d67a25f4984467e7b95Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/affae18838db5e6b463ee30c821385695af56dc2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/db98de0809f12b0edb9cd1be78e1ec1bfeba8f40Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4ce77b023d42a9f1062eecf438df1af4b4072eb2Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7b439aaa62fee474a0d84d67a25f4984467e7b95Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/affae18838db5e6b463ee30c821385695af56dc2Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/db98de0809f12b0edb9cd1be78e1ec1bfeba8f40Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "06B6ACCF-31F1-4421-964C-7F3C54F0E3E2",
                     versionEndExcluding: "6.1.64",
                     versionStartIncluding: "6.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "674C4F82-C336-4B49-BF64-1DE422E889C4",
                     versionEndExcluding: "6.5.13",
                     versionStartIncluding: "6.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B58252FA-A49C-411F-9B28-DC5FE44BC5A0",
                     versionEndExcluding: "6.6.3",
                     versionStartIncluding: "6.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: qcom-spmi-pmic: Fix revid implementation\n\nThe Qualcomm SPMI PMIC revid implementation is broken in multiple ways.\n\nFirst, it assumes that just because the sibling base device has been\nregistered that means that it is also bound to a driver, which may not\nbe the case (e.g. due to probe deferral or asynchronous probe). This\ncould trigger a NULL-pointer dereference when attempting to access the\ndriver data of the unbound device.\n\nSecond, it accesses driver data of a sibling device directly and without\nany locking, which means that the driver data may be freed while it is\nbeing accessed (e.g. on driver unbind).\n\nThird, it leaks a struct device reference to the sibling device which is\nlooked up using the spmi_device_from_of() every time a function (child)\ndevice is calling the revid function (e.g. on probe).\n\nFix this mess by reimplementing the revid lookup so that it is done only\nat probe of the PMIC device; the base device fetches the revid info from\nthe hardware, while any secondary SPMI device fetches the information\nfrom the base device and caches it so that it can be accessed safely\nfrom its children. If the base device has not been probed yet then probe\nof a secondary device is deferred.",
      },
      {
         lang: "es",
         value: "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mfd: qcom-spmi-pmic: reparación de la implementación revid. La implementación revid de Qualcomm SPMI PMIC está rota de varias maneras. En primer lugar, se supone que el hecho de que el dispositivo base hermano se haya registrado significa que también está vinculado a un controlador, lo que puede no ser el caso (por ejemplo, debido a un aplazamiento de la sonda o una sonda asincrónica). Esto podría desencadenar una desreferencia del puntero NULL al intentar acceder a los datos del controlador del dispositivo independiente. En segundo lugar, accede a los datos del controlador de un dispositivo hermano directamente y sin ningún bloqueo, lo que significa que los datos del controlador pueden liberarse mientras se accede a ellos (por ejemplo, al desvincular el controlador). En tercer lugar, filtra una referencia de dispositivo de estructura al dispositivo hermano que se busca usando spmi_device_from_of() cada vez que un dispositivo de función (secundario) llama a la función revid (por ejemplo, en la sonda). Solucione este problema volviendo a implementar la búsqueda revid para que se realice solo en la sonda del dispositivo PMIC; el dispositivo base obtiene la información revid del hardware, mientras que cualquier dispositivo SPMI secundario obtiene la información del dispositivo base y la almacena en caché para que sus hijos puedan acceder a ella de forma segura. Si el dispositivo base aún no ha sido sondeado, se pospone la sonda de un dispositivo secundario.",
      },
   ],
   id: "CVE-2023-52765",
   lastModified: "2025-04-02T15:03:42.840",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 6.2,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.5,
            impactScore: 3.6,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2024-05-21T16:15:15.777",
   references: [
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/4ce77b023d42a9f1062eecf438df1af4b4072eb2",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/7b439aaa62fee474a0d84d67a25f4984467e7b95",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/affae18838db5e6b463ee30c821385695af56dc2",
      },
      {
         source: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/db98de0809f12b0edb9cd1be78e1ec1bfeba8f40",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/4ce77b023d42a9f1062eecf438df1af4b4072eb2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/7b439aaa62fee474a0d84d67a25f4984467e7b95",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/affae18838db5e6b463ee30c821385695af56dc2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://git.kernel.org/stable/c/db98de0809f12b0edb9cd1be78e1ec1bfeba8f40",
      },
   ],
   sourceIdentifier: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-476",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.