CVE-2023-53834

Vulnerability

Overview

In the Linux kernel's IIO subsystem, the ina2xx ADC driver (drivers/iio/adc/ina2xx.c) contains a NULL pointer dereference vulnerability arising from inconsistent handling of device tree (OF) matching and legacy I2C device ID tables. When a device tree node specifies a list of compatible strings (e.g., "ti,ina232" followed by "ti,ina231"), the kernel's OF matching logic selects the best match, which may be a later compatible string. However, the I2C driver model populates the device ID info based on the first compatible string in the list. If that first string does not exist in the driver's i2c_device_id table (e.g., "ti,ina232" is not listed), then during probe the struct i2c_device_id *id pointer is NULL, and the driver dereferences it, causing a crash.

Exploitation

Prerequisites

This vulnerability is triggered on systems where a device tree contains a compatible string that is not directly declared in the driver but is used in a list with a supported string. The attacker must be able to control or influence the device tree content, typically in embedded or IoT scenarios where custom device trees are loaded. No special privileges beyond the ability to boot the kernel with the crafted device tree are required; the vulnerability occurs during kernel initialization.

Impact

An attacker who can supply a malicious device tree can cause a NULL pointer dereference in the kernel, leading to a denial of service (system crash or hang). The impact is limited to availability; there is no evidence of privilege escalation, memory corruption, or information disclosure from this bug.

Mitigation

The fix, committed upstream as commit 77b689cc27d489b75d33f1a368356d70eb0ce08c [1], resolves the issue by using the already-populated type variable (which points to proper driver data) instead of the potentially NULL id pointer. The driver also adds a generic name to the ina2xx_config table. This fix should be included in kernels starting from the timeframe of publication (2025-12-09). There is no indication this CVE is listed in CISA's Known Exploited Vulnerabilities catalog.