CVE-2023-54079

Vulnerability

In the Linux kernel's bq27xxx battery driver, the bq27xxx_battery_teardown() function set poll_interval = 0 to prevent the delayed work item from being requeued. This approach had two flaws: it could unexpectedly change the module parameter poll_interval when the driver was unbound via sysfs, and it was racy because poll_interval could be modified concurrently through /sys/module/bq27xxx_battery/parameters/poll_interval before the work function checks it [1].

Exploitation

An attacker with local access could exploit this race condition by triggering a device removal (e.g., via sysfs unbind) while simultaneously writing to the poll_interval sysfs parameter. This could cause the delayed work item to be requeued after the device has been torn down, leading to a use-after-free condition [1].

Impact

Successful exploitation could result in a kernel crash (denial of service) or potentially arbitrary code execution, depending on the memory state. The vulnerability affects systems using the bq27xxx battery driver, which is common in many Linux-based devices Linux-based devices.

Mitigation

The fix introduces a removed flag in struct bq27xxx_device_info and moves the device removal from the bq27xxx_battery_devices list to before cancelling the delayed work item, eliminating the race condition [1]. Patches are available in the stable kernel tree; users should update to the latest kernel version.