CVE-2023-54249

Root

Cause

In the Linux kernel's MHI (Modem Host Interface) endpoint driver, a flaw exists in the handling of STOP and RESET channel commands. The vulnerability arises because the driver unconditionally attempts to send the -ENOTCONN status to the client driver, even when that client driver is not present or available. This leads to a null pointer dereference.

Exploitation

An attacker with the ability to send crafted MHI commands to the endpoint could trigger the STOP or RESET command path when no client driver is bound. The prerequisite is access to the MHI bus communication, which may require local access or a compromised component that can issue MHI commands.

Impact

Successful exploitation causes a kernel NULL pointer dereference, resulting in a denial of service (system crash or panic). No privilege escalation or data leakage is described in the source.

Mitigation

The fix was applied in the Linux kernel stable tree via commit [1] and is included in updated kernel releases. Users should apply the latest stable kernel updates to remediate the vulnerability. No workaround is mentioned in the reference.