Linux Kernel Vulnerability in Coretemp Platform Driver by Vendor

CVE-2023-53612

What is CVE-2023-53612?

A notable issue exists in the handling of Coretemp's platform driver within the Linux kernel. The driver operates unconventionally, relying heavily on an initcall and CPU hotplug notifiers for its functionality, which leads to complex interactions that can cause NULL dereferences under certain configurations. This vulnerable implementation can result in deadlocks during suspend operations and create potential lock dependency issues for other drivers. By simplifying the platform device management and directly linking the devices to the module's lifecycle, significant improvements can be made to enhance stability and reduce errors while maintaining the expected behavior of hardware monitoring interfaces.

References