CVE-2023-53472

What it actually does

Null pointer dereference in the lpc32xx PWM driver when chip.pwms is accessed before devm_pwmchip_add() completes initialization, due to unconditional operations on pwm->hwpwm despite single-channel design.

Why it matters to the business

Kernel crashes or panics on systems using LPC32xx PWM hardware can cause denial of service, system reboots, and disruption to embedded or industrial Linux deployments; high prevalence in kernel ecosystems increases exposure for affected Debian and mainline users.

How an attack unfolds

An attacker with local access or the ability to trigger PWM device probe on vulnerable LPC32xx hardware loads or initializes the driver, causing the null dereference during channel handling before the chip is registered; listed actors such as VMSCAPE have been associated with similar kernel privilege issues but no public exploits target this specific flaw.

How to fix it

Upgrade to fixed kernel versions including 4.14.326 or commit abd9b2ee4047ccd980decbf26d61f9637604b1d5; Debian 11/12/13/14 users should install linux 5.7.17-1 or later packages; remove or disable the lpc32xx PWM driver if hardware is not present.

How to confirm the fix worked

Verify kernel version against fixed releases, inspect driver source for removal of pwm->hwpwm operations, and confirm absence of null dereference during PWM probe in test environments with the controller.

Typical attack path

1. Obtain local code execution or physical access on target Linux system with LPC32xx PWM controller
2. Trigger PWM driver initialization or device probe sequence
3. Cause access to uninitialized lpc32xx->chip.pwms pointer
4. Induce kernel null pointer dereference leading to panic or oops

How to detect it

Search kernel logs and dmesg for null pointer dereference oops mentioning pwm-lpc32xx or lpc32xx during driver load; review audit trails for unexpected PWM device initialization on affected hardware.

• pwm-lpc32xx
• lpc32xx->chip.pwms
• devm_pwmchip_add
• Unable to handle kernel NULL pointer dereference

What your security team should do

• Prioritize kernel upgrades on all affected Linux and Debian systems within standard patch cycles given low EPSS
• Audit embedded deployments for LPC32xx PWM usage and apply fixed versions immediately
• Monitor for kernel oops reports involving pwm-lpc32xx in production logs