Listen to this Post
The vulnerability is a NULL pointer dereference in the `mtk_pmic_keys_probe` function of the Linux kernel’s MediaTek PMIC keys driver. During device initialization, the function `of_match_device()` is called to retrieve platform-specific data from the Device Tree. On hardware where a physical button is absent or left floating, the corresponding Device Tree node is often removed. In this case, `of_match_device()` returns a NULL pointer. The vulnerable code did not check this return value before dereferencing the `of_id->data` pointer to access the `regs` parameter. Attempting to read from the NULL pointer address (0x00000000000000c0) triggers a fatal kernel oops—a level 0 translation fault—leading to a system crash and denial of service. The fix involves adding a NULL check after the function call and using a static `regs` structure defined for all platforms instead of the conditional one.
DailyCVE Form
Platform: Linux kernel
Version: Affected versions
Vulnerability: Null pointer dereference
Severity: Medium (5.5)
Date: 2025-05-20
Prediction: 2025-06-30
What Undercode Say
Check if the vulnerable module is loaded lsmod | grep mtk_pmic_keys Check kernel version uname -r Example kernel error log from exploitation [ 1.123456] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 1.123457] Internal error: Oops: 96000004 [bash] SMP [ 1.123458] Call trace: [ 1.123459] mtk_pmic_keys_probe+0x94/0x500
// Code patch that fixes the vulnerability const struct of_device_id of_id = of_match_device(of_mtk_pmic_keys_match_tbl, &pdev->dev); if (!of_id) return -EINVAL; // Added NULL pointer check
How Exploit
An attacker with local access can cause a kernel panic and denial of service by inducing the `mtk_pmic_keys` driver’s probe function on compatible MediaTek hardware where a button node is absent from the Device Tree. This triggers the NULL pointer dereference during kernel initialization or module loading, crashing the system.
Protection from this CVE
Apply kernel patches.
Update Linux kernel.
Disable vulnerable driver.
Impact
Denial of service.
Kernel panic crash.
Local system instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
