CVE-2023-52627

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
26/03/2024
Last modified:
29/04/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: adc: ad7091r: Allow users to configure device events<br /> <br /> AD7091R-5 devices are supported by the ad7091r-5 driver together with<br /> the ad7091r-base driver. Those drivers declared iio events for notifying<br /> user space when ADC readings fall bellow the thresholds of low limit<br /> registers or above the values set in high limit registers.<br /> However, to configure iio events and their thresholds, a set of callback<br /> functions must be implemented and those were not present until now.<br /> The consequence of trying to configure ad7091r-5 events without the<br /> proper callback functions was a null pointer dereference in the kernel<br /> because the pointers to the callback functions were not set.<br /> <br /> Implement event configuration callbacks allowing users to read/write<br /> event thresholds and enable/disable event generation.<br /> <br /> Since the event spec structs are generic to AD7091R devices, also move<br /> those from the ad7091r-5 driver the base driver so they can be reused<br /> when support for ad7091r-2/-4/-8 be added.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.6 (including) 5.10.210 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.149 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.76 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.15 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.7.3 (excluding)
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*