CVE-2023-54321

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential null-ptr-deref in device_add()

I got the following null-ptr-deref report while doing fault injection test:

BUG: kernel NULL pointer dereference, address: 0000000000000058

CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+

RIP: 0010:klist_put+0x2d/0xd0

Call Trace:

<TASK>

klist_remove+0xf1/0x1c0

device_release_driver_internal+0x196/0x210

bus_remove_device+0x1bd/0x240

device_add+0xd3d/0x1100

w1_add_master_device+0x476/0x490 [wire]

ds2482_probe+0x303/0x3e0 [ds2482]

This is how it happened:

w1_alloc_dev()

// The dev->driver is set to w1_master_driver.

memcpy(&dev->dev, device, sizeof(struct device));

device_add()

bus_add_device()

dpm_sysfs_add() // It fails, calls bus_remove_device.

// error path

bus_remove_device()

// The dev->driver is not null, but driver is not bound.

__device_release_driver()

klist_remove(&dev->p-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References