CVE-2022-50634

Vulnerability

Overview

In the Linux kernel, the cw2015 power supply driver suffers from a null-pointer dereference vulnerability in the cw_bat_probe() function. The function calls create_singlethread_workqueue() to allocate a workqueue, but does not check its return value. If the allocation fails (e.g., due to memory pressure), the function continues to use the NULL pointer cw_bat->wq in subsequent workqueue operations, such as queue_delayed_work(), which ultimately leads to a null-pointer dereference when accessing wq->flags in __queue_work().

Exploitation

Prerequisites

Exploitation requires the ability to trigger the probe of a cw2015 device. This can occur when the corresponding hardware is present and the driver is loaded, or when a malicious device is introduced (e.g., via USB or other hot-plug interfaces). No authentication is explicitly required; the attack may be initiated by a local user who can cause the driver to bind to a device. The vulnerability can be triggered without any special privileges beyond the ability to cause device enumeration.

Impact

A successful null-pointer dereference results in a kernel crash, causing a denial of service (DoS). Given that the crash occurs in kernel context, it may also lead to system instability or, in some configurations, privilege escalation if an attacker can control the kernel memory layout. However, the primary impact as described is a denial of service.

Mitigation

The fix, committed to the Linux kernel stable tree [1], adds a check on the return value of create_singlethread_workqueue(). If it returns NULL, the function now returns -ENOMEM and cleans up allocated resources, preventing the null-pointer dereference. Users should apply the latest kernel updates to protect against this vulnerability.