Null Pointer Dereference Vulnerability in Linux Kernel’s TW68 Driver

CVE-2023-53244

What is CVE-2023-53244?

A vulnerability exists within the Linux Kernel’s TW68 driver that can lead to a null pointer dereference. When the driver invokes the tw68_risc_buffer() function to prepare a buffer, it may encounter failure during dma_alloc_coherent, leaving the buffer's CPU field empty. This situation can trigger a null pointer dereference upon subsequent buffer access or deallocation. The vulnerability may be exploited dynamically from a user-side context. It has been addressed by implementing checks on the return value of tw68_risc_buffer() and validating buf->cpu before freeing the buffer, thereby enhancing the driver’s reliability.

References