CVE-2023-53166

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq25890: Fix external_power_changed race

bq25890_charger_external_power_changed() dereferences bq->charger,

which gets sets in bq25890_power_supply_init() like this:

bq->charger = devm_power_supply_register(bq->dev, &bq->desc, &psy_cfg);

As soon as devm_power_supply_register() has called device_add()

the external_power_changed callback can get called. So there is a window

where bq25890_charger_external_power_changed() may get called while

bq->charger has not been set yet leading to a NULL pointer dereference.

This race hits during boot sometimes on a Lenovo Yoga Book 1 yb1-x90f

when the cht_wcove_pwrsrc (extcon) power_supply is done with detecting

the connected charger-type which happens to exactly hit the small window:

BUG: kernel NULL pointer dereference, address: 0000000000000018

<snip>

RIP: 0010:__power_supply_is_supplied_by+0xb/0xb0

<snip>

Call Trace:

<TASK>

__power_supply_ge

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References