linux-cve-announce - CVE-2023-52765: mfd: qcom-spmi-pmic: Fix revid implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052148-CVE-2023-52765-3bc7@gregkh>
Date: Tue, 21 May 2024 17:31:01 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52765: mfd: qcom-spmi-pmic: Fix revid implementation

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mfd: qcom-spmi-pmic: Fix revid implementation

The Qualcomm SPMI PMIC revid implementation is broken in multiple ways.

First, it assumes that just because the sibling base device has been
registered that means that it is also bound to a driver, which may not
be the case (e.g. due to probe deferral or asynchronous probe). This
could trigger a NULL-pointer dereference when attempting to access the
driver data of the unbound device.

Second, it accesses driver data of a sibling device directly and without
any locking, which means that the driver data may be freed while it is
being accessed (e.g. on driver unbind).

Third, it leaks a struct device reference to the sibling device which is
looked up using the spmi_device_from_of() every time a function (child)
device is calling the revid function (e.g. on probe).

Fix this mess by reimplementing the revid lookup so that it is done only
at probe of the PMIC device; the base device fetches the revid info from
the hardware, while any secondary SPMI device fetches the information
from the base device and caches it so that it can be accessed safely
from its children. If the base device has not been probed yet then probe
of a secondary device is deferred.

The Linux kernel CVE team has assigned CVE-2023-52765 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.0 with commit e9c11c6e3a0e and fixed in 6.1.64 with commit db98de0809f1
	Issue introduced in 6.0 with commit e9c11c6e3a0e and fixed in 6.5.13 with commit 4ce77b023d42
	Issue introduced in 6.0 with commit e9c11c6e3a0e and fixed in 6.6.3 with commit affae18838db
	Issue introduced in 6.0 with commit e9c11c6e3a0e and fixed in 6.7 with commit 7b439aaa62fe

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52765
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/mfd/qcom-spmi-pmic.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/db98de0809f12b0edb9cd1be78e1ec1bfeba8f40
	https://git.kernel.org/stable/c/4ce77b023d42a9f1062eecf438df1af4b4072eb2
	https://git.kernel.org/stable/c/affae18838db5e6b463ee30c821385695af56dc2
	https://git.kernel.org/stable/c/7b439aaa62fee474a0d84d67a25f4984467e7b95