Linux Kernel I2C Adapter Registration Race Vulnerability

A race condition vulnerability in the Linux kernel's I2C core has been addressed. The issue arose during the registration of I2C adapters, which can be looked up by their ID using the 'i2c_get_adapter()' function. This function references the associated 'struct device', necessitating that the adapter be fully initialized before it is added to the IDR (Identifier Radix Tree). Failure to do so could result in accessing uninitialized data, potentially leading to NULL-pointer dereferences or use-after-free errors. The vulnerability was particularly relevant for the 'i2c-dev' character device, which is registered via a bus notifier and relies on 'i2c_get_adapter()'. Therefore, it was crucial to add the adapter to the IDR before its registration.

Impact

The vulnerability could cause NULL-pointer dereferences or use-after-free errors, which are common sources of memory corruption issues that can be exploited to execute arbitrary code or cause a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by creating an I2C adapter and registering it without ensuring that it is fully initialized. This can be done by using the 'i2c_add_numbered_adapter()' function, which does not check if the adapter is ready before adding it to the IDR. Once the adapter is registered, the 'i2c_get_adapter()' function can be called to retrieve it, leading to the race condition.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.