Linux Kernel LPC32XX PWM Channel Handling Vulnerability Null Pointer Dereference

A null pointer dereference vulnerability has been identified in the Linux kernel's handling of PWM channels for LPC32XX controllers. This issue arises because these controllers have only one output, which is registered as the sole PWM device per controller. As a result, the 'hwpwm' value is always 0. The vulnerability occurs when the 'pwms' array is NULL before the PWM chip is registered, leading to a null pointer dereference. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability can be exploited to cause a null pointer dereference, leading to a crash of the affected system.

Reproduction

The vulnerability can be reproduced by using an LPC32XX PWM controller in a Linux kernel version that is affected by this issue. The PWM controller will only have a single output registered, causing the 'hwpwm' value to be 0. When the PWM chip is probed, the 'pwms' array will be NULL, leading to a null pointer dereference when the 'hwpwm' value is accessed.

Remediation

Users can upgrade to the latest version of the Linux kernel, where this vulnerability has been addressed.