CVE-2023-52877

What it actually does

NULL pointer dereference in tcpm_pd_data_request when typec_register_partner returns an error pointer, causing port->partner to be dereferenced without validation during USB PD SVDM message processing.

Why it matters to the business

Kernel crashes on Linux systems during USB Type-C Power Delivery operations can lead to system instability, denial of service, and potential data loss on servers, desktops, and embedded devices using affected kernel versions.

How an attack unfolds

An attacker with physical or local access triggers a USB Type-C partner registration failure (error -17), causing the kernel to skip the error check and dereference an invalid pointer in the PD data request handler, resulting in a crash. No named threat actors have been observed exploiting this specific flaw.

How to fix it

Update to a kernel containing commit e5f53a68a596e04df3fde3099273435a30b6fdac which adds the missing check for port->partner before use. Apply the fix via distribution kernel packages or rebuild from the stable git tree.

How to confirm the fix worked

Confirm the patch is present by checking for the added error check on port->partner in tcpm_pd_svdm or tcpm_pd_data_request; reproduce the registration failure scenario in a test environment and verify no crash occurs.

Typical attack path

1. Connect a USB Type-C device or cable that causes typec_register_partner to fail
2. Send USB PD data messages that reach tcpm_pd_data_request
3. Trigger the unchecked dereference of the error-valued partner pointer
4. Cause kernel NULL pointer dereference and panic

How to detect it

Search kernel logs for 'failed to register partner (-17)' followed by 'Unable to handle kernel NULL pointer dereference' and stack traces referencing tcpm_pd_data_request; examine kmsg or dmesg for the exact call trace shown in the advisory.

What your security team should do

• Prioritize patching all exposed Linux systems to the fixed commit
• Monitor kernel logs for 'failed to register partner' messages as indicators of potential trigger conditions
• Restrict physical USB Type-C access on critical systems until patched