CVE-2023-53856

What it actually does

NULL-pointer dereference in overlay_removal_is_ok() during cleanup of a partially applied device tree overlay when of_resolve_phandles() fails before changeset initialization.

Why it matters to the business

Unprivileged local users or automated overlay application can trigger kernel crashes, leading to denial of service on systems that dynamically apply device tree overlays.

How an attack unfolds

An attacker supplies a device tree overlay containing unresolved symbols to of_overlay_fdt_apply(); symbol resolution fails, leaving the changeset list uninitialized, and subsequent cleanup path dereferences a NULL pointer causing a crash.

How to fix it

Update the Linux kernel to a version containing commit 01bb96ad38089f5cc6de7746dac13437d35eb1dc or apply the equivalent Ubuntu package updates for leptonlib where backported (1.73-1ubuntu0.1~esm1, 1.75.3-2, 1.70.1-1ubuntu0.1~esm1). Reboot after kernel updates.

How to confirm the fix worked

Confirm the presence of commit 01bb96ad38089f5cc6de7746dac13437d35eb1dc in the running kernel source or verify package versions match the listed fixed releases; test overlay application with intentionally unresolved symbols to ensure no crash occurs.

Typical attack path

1. Obtain ability to invoke of_overlay_fdt_apply() (local access or privileged process)
2. Craft overlay FDT with unresolved phandle symbols
3. Trigger overlay application via sysfs or kernel API
4. Force failure in of_resolve_phandles()
5. Trigger cleanup path that dereferences uninitialized changeset

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference crashes mentioning overlay_removal_is_ok or of_overlay_fdt_apply; correlate with processes or scripts that apply device tree overlays.

What your security team should do

• Prioritize kernel updates on systems that apply device tree overlays
• Restrict unprivileged access to overlay application interfaces until patched
• Monitor for kernel oops or NULL dereference logs in dmesg related to of_overlay