CVE-2023-52765

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mfd: qcom-spmi-pmic: Fix revid implementation

The Qualcomm SPMI PMIC revid implementation is broken in multiple ways.

First, it assumes that just because the sibling base device has been

registered that means that it is also bound to a driver, which may not

be the case (e.g. due to probe deferral or asynchronous probe). This

could trigger a NULL-pointer dereference when attempting to access the

driver data of the unbound device.

Second, it accesses driver data of a sibling device directly and without

any locking, which means that the driver data may be freed while it is

being accessed (e.g. on driver unbind).

Third, it leaks a struct device reference to the sibling device which is

looked up using the spmi_device_from_of() every time a function (child)

device is calling the revid function (e.g. on probe).

Fix this mess by reimplementing the revid lookup so that it is done only

at probe of the PMIC device; the base

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References