Unprotected Debugfs Reads in Linux Kernel IIO Gyro ADIS16136

Executive Summary

This vulnerability in the Linux kernel involves a missing protection in the debugfs interface for the ADIS16136 gyroscope driver. The serial_number file was created using an unsafe debugfs function but did not implement the required debugfs_file_get() call. This oversight allows the debugfs_remove_recursive() function to remove the file while a read operation is still in progress, potentially leading to a use-after-free condition when the device is unbound.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO gyro driver for the ADIS16136 device. Detection requires checking the kernel version and the presence of the affected driver. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep adis16136' to verify if the driver is loaded.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with local access to cause a system crash or execute arbitrary code by triggering a race condition during a debugfs read operation. It may also lead to privilege escalation if combined with other kernel vulnerabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the kernel update that resolves this issue. If the driver is not in use, unload it with 'rmmod adis16136'. Ensure debugfs operations are properly protected by using debugfs_create_file() instead of debugfs_create_file_unsafe().

Useful 0 Not Useful 0