CVE-2023-54314

Vulnerability

In the Linux kernel's af9005 driver, the af9005_i2c_xfer function lacks a sanity check on msg[i].len when msg[i].buf is null. A user-controlled message with a null buffer and zero length bypasses earlier checks, leading to a null-pointer dereference when accessing msg[i].buf[0]. This is similar to a previously fixed issue in the az6027 driver.

Exploitation

An attacker with local access can trigger this vulnerability by passing a crafted i2c_msg structure to the driver via the I2C interface. The vulnerability requires no special privileges beyond the ability to interact with the device file, making it exploitable from user space.

Impact

Successful exploitation causes a null-pointer dereference, resulting in a kernel crash (denial of service). Due to the instability induced, this could potentially be leveraged for privilege escalation on systems lacking panic-based protections, though the primary impact is availability.

Mitigation

The vulnerability is fixed by adding a check on msg[i].len before accessing the buffer. Patches have been applied to the Linux kernel and backported to stable branches as seen in commits [1][2][3][4]. Users should update their kernel to a version containing the fix.