CVE-2023-54319

Vulnerability

In the Linux kernel's pinctrl-at91-pio4 driver, the function devm_kasprintf() is called without checking its return value. This function allocates memory dynamically and can return NULL if the allocation fails. The missing check could lead to a NULL pointer dereference when the returned pointer is subsequently used.

Exploitation

An attacker with the ability to trigger a memory allocation failure (e.g., via exhausting system memory) could cause the driver to dereference a NULL pointer. This would likely result in a kernel crash, denying service to legitimate users. No special privileges are required if the attacker can influence memory pressure.

Impact

Successful exploitation results in a denial of service (system crash). This is a low-severity issue that requires local access or a specific system condition to trigger.

Mitigation

The fix was applied in commit [1] and included in subsequent stable kernel releases. Users should update their kernels to a version containing this patch.