Null Pointer Dereference in Linux Kernel Driver Core Issue

CVE-2023-54321

What is CVE-2023-54321?

The Linux kernel contains a vulnerability in the driver core where a null pointer dereference can occur during the device addition process. This issue arises when the device's driver is set but the driver is not fully bound. Specifically, if an error occurs post bus_add_device() call in device_add(), and bus_remove_device() is triggered without a corresponding device_bind_driver() call, it results in an attempt to access a null 'knode_driver'. The fix involves ensuring that the device's driver pointer is nulled out on error paths before any device removal processes occur.

References