CVE-2023-53310: power: supply: axp288_fuel_gauge: Fix external_power_changed race
In the Linux kernel, the following vulnerability has been resolved:
power: supply: axp288fuelgauge: Fix externalpowerchanged race
fuelgaugeexternalpowerchanged() dereferences info->bat, which gets sets in axp288fuelgaugeprobe() like this:
info->bat = devmpowersupplyregister(dev, &fuelgaugedesc, &psycfg);
As soon as devmpowersupplyregister() has called deviceadd() the externalpowerchanged callback can get called. So there is a window where fuelgaugeexternalpowerchanged() may get called while info->bat has not been set yet leading to a NULL pointer dereference.
Fixing this is easy. The externalpowerchanged callback gets passed the powersupply which will eventually get stored in info->bat, so fuelgaugeexternalpowerchanged() can simply directly use the passed in psy argument which is always valid.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53310?
CVE-2023-53310 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-53310?
To fix CVE-2023-53310, ensure that you update the Linux kernel to the latest stable version that addresses this vulnerability.
What does CVE-2023-53310 affect?
CVE-2023-53310 affects the Linux kernel, specifically the axp288 fuel gauge functionality.
Is CVE-2023-53310 an exploitation risk?
Yes, CVE-2023-53310 presents an exploitation risk due to a race condition in the power supply management.
When was CVE-2023-53310 reported?
CVE-2023-53310 was reported and has been addressed in recent updates to the Linux kernel.