CVE-2023-54079

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq27xxx: Fix poll_interval handling and races on remove

Before this patch bq27xxx_battery_teardown() was setting poll_interval = 0

to avoid bq27xxx_battery_update() requeuing the delayed_work item.

There are 2 problems with this:

1. If the driver is unbound through sysfs, rather then the module being

rmmod-ed, this changes poll_interval unexpectedly

2. This is racy, after it being set poll_interval could be changed

before bq27xxx_battery_update() checks it through

/sys/module/bq27xxx_battery/parameters/poll_interval

Fix this by added a removed attribute to struct bq27xxx_device_info and

using that instead of setting poll_interval to 0.

There also is another poll_interval related race on remove(), writing

/sys/module/bq27xxx_battery/parameters/poll_interval will requeue

the delayed_work item for all devices on the bq27xxx_battery_devices

list and the device being removed was only removed f

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References