CVE-2023-54027

What it actually does

NULL pointer dereference in __iio_device_register when an IIO device lacks a parent, triggered during label retrieval after the firmware node conversion.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or panics, leading to denial of service and potential loss of availability for IIO-dependent workloads.

How an attack unfolds

An attacker with sufficient privileges to interact with configfs creates a dummy IIO device entry, causing the kernel to dereference a NULL parent pointer during device registration and resulting in a BUG.

How to fix it

Upgrade to a fixed kernel containing commit 312f04ede209f0a186799fe8e64a19b49700d5dc or later; for Chainguard and Wolfi distributions update dive to 0.13.1-r3 or newer.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary, then attempt dummy device creation in configfs and verify no NULL dereference occurs.

Typical attack path

1. Obtain local access to a system with the vulnerable IIO subsystem enabled.
2. Navigate to or mount configfs at /sys/kernel/config.
3. Execute mkdir /sys/kernel/config/iio/devices/dummy/<name> to trigger registration.
4. Observe kernel NULL pointer dereference and potential system instability or crash.

How to detect it

Review kernel logs for NULL pointer dereference oops mentioning __iio_device_register or iio_dummy_probe; search audit or command history for configfs mkdir operations under /sys/kernel/config/iio/devices/dummy.

• BUG: kernel NULL pointer dereference
• __iio_device_register
• iio_dummy_probe
• mkdir /sys/kernel/config/iio/devices/dummy/

What your security team should do

• Prioritize kernel updates on systems exposing IIO or configfs interfaces.
• Restrict unprivileged access to configfs where possible via mount options or permissions.
• Monitor for kernel oops reports related to iio_device_register.