Executive brief
The Linux kernel's BQ27xxx battery management driver contains a race condition that can occur when the driver is unbound or removed from a device. An attacker or unprivileged user with the ability to unbind the driver via sysfs and manipulate the poll interval parameter could trigger a use-after-free condition, potentially leading to kernel crashes or local privilege escalation on systems using BQ27xxx battery monitors.
Technical details
This vulnerability is a use-after-free race condition in the bq27xxx_battery driver's teardown path. The vulnerable code relied on setting poll_interval to 0 to prevent bq27xxx_battery_update() from requeuing delayed_work, but this approach had two flaws: (1) it unexpectedly modified global state when the driver was unbound via sysfs rather than rmmod, and (2) it was racy—poll_interval could be changed via sysfs between when it was set to 0 and when it was checked, causing delayed_work to be requeued after the device was partially torn down. Additionally, writing to /sys/module/bq27xxx_battery/parameters/poll_interval could requeue delayed_work for devices still in the global list even after cancel_delayed_work_sync() was called. The fix adds a per-device "removed" boolean flag and reorders teardown operations to remove the device from the global list before setting the flag and canceling work. Attack vector requires local access and ability to manipulate sysfs parameters. Patch is available in upstream Linux kernel.
Affected products
- Linux Linux Kernel multiple versions (bq27xxx driver)
Timeline
- 2023-04-15: disclosed: Fix authored by Hans de Goede
- 2023-05-30: patched: Patch merged into stable Linux kernel by Greg Kroah-Hartman