CVE-2023-52473

What it actually does

NULL pointer dereference in thermal_zone_device_register_with_trips() error path after device_register() fails, where tz is set to NULL before kfree(tz->tzp) is reached, causing a kernel crash.

Why it matters to the business

Local users on affected Linux kernels can trigger system instability or denial of service through thermal zone registration failures, increasing operational risk for servers and devices that rely on thermal management.

How an attack unfolds

An attacker with local access crafts conditions that cause device_register() to fail during thermal zone registration, leading the kernel to follow the buggy error path and dereference the NULL pointer.

How to fix it

Upgrade the Linux kernel to the fixed commit 335176dd8ebaca6493807dceea33c478305667fa or later stable releases containing the fix.

How to confirm the fix worked

Verify the running kernel includes commit 335176dd8ebaca6493807dceea33c478305667fa and confirm the NULL assignment has been removed from the error path in thermal_core.c.

Typical attack path

1. Obtain local access on a vulnerable Linux system
2. Trigger thermal zone device registration that forces device_register() failure
3. Kernel follows error path and dereferences NULL tz pointer
4. Resulting oops or panic disrupts system availability

How to detect it

Review kernel logs for oops or panic messages containing thermal_zone_device_register or references to tzp dereference in the thermal core.

What your security team should do

• Apply the kernel fix immediately on all affected systems
• Prioritize updates for production servers and embedded devices using thermal zones
• Monitor for kernel panics related to thermal registration until patched