CVE-2023-53049

In the Linux kernel, the following vulnerability has been resolved:

usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()

When ucsi_init() fails, ucsi->connector is NULL, yet in case of ucsi_acpi we may still get events which cause the ucs_acpi code to call ucsi_connector_change(), which then derefs the NULL ucsi->connector pointer.

Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() has succeeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask.

A NULL pointer dereference vulnerability in the UCSI USB Type-C subsystem was fixed in ucsi_connector_change(). If ucsi_init() fails, a race condition may cause connector change events to be processed with an uninitialized ucsi->connector, leading to a kernel crash. This can be triggered locally from userspace on systems with UCSI ACPI interface, but requires high privileges and a specific device configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.