LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53472: pwm: lpc32xx: Remove handling of PWM channels

In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Because LPC32xx PWM controllers have only a single output which is registered as the only PWM device/channel per controller, it is known in advance that pwm->hwpwm value is always 0. On basis of this fact simplify the code by removing operations with pwm->hwpwm, there is no controls which require channel number as input. Even though I wasn't aware at the time when I forward ported that patch, this fixes a null pointer dereference as lpc32xx->chip.pwms is NULL before devm_pwmchip_add() is called.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE covers a Linux kernel bug in the LPC32xx PWM driver that can trigger a null pointer dereference. The available sources describe a kernel stability issue, not data theft or remote compromise. Exposure appears limited to systems using the LPC32xx PWM controller driver on affected kernel versions.

Executive priority

Treat this as a targeted embedded Linux maintenance item unless LPC32xx devices are business-critical. There is no sourced evidence of active exploitation or broad internet exposure, but affected operational technology or appliance fleets should patch through normal kernel update channels.

Technical view

The issue is in Linux kernel pwm-lpc32xx handling. The controller has one PWM output, so channel handling was unnecessary. Before devm_pwmchip_add(), lpc32xx->chip.pwms can be NULL, and prior code could dereference it. Stable kernel commits remove the channel-dependent handling.

Likely exposure

Most relevant to embedded or hardware-specific Linux deployments using LPC32xx PWM support. General Linux servers, desktops, and cloud workloads are unlikely to be exposed unless this driver and hardware path are present. The source bundle lists affected Linux kernel versions and multiple stable commit references, but no CVSS score.

Exploitation context

CISA KEV is false in the provided bundle, and no cited source states active exploitation. The public record describes a null pointer dereference fix, but does not provide exploitability details, attacker prerequisites, or whether the crash is reachable by unprivileged users.

Researcher notes

Key uncertainty is reachability. Sources identify the null dereference and fixed code path, but do not define attacker control, privilege requirements, or impact beyond kernel fault potential. Focus validation on driver presence, hardware use, and whether stable fixes are present in downstream kernels.

Mitigation direction

  • Update to a kernel release or vendor build containing the referenced stable fixes.
  • For vendor kernels, confirm whether the fix was backported rather than relying on version strings.
  • Prioritize LPC32xx-based embedded devices or images with the pwm-lpc32xx driver enabled.
  • Monitor Linux distribution and device vendor advisories for product-specific guidance.

Validation and detection

  • Inventory kernel versions and hardware platforms for LPC32xx PWM usage.
  • Verify the running kernel includes one of the referenced stable fixes or an equivalent backport.
  • Check kernel crash telemetry for null pointer dereferences involving the LPC32xx PWM driver.
  • Regression-test PWM functionality on patched LPC32xx devices before broad rollout.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53472 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbb4de81eb940e7027f37a6fd3b7ddcb4403deb56, 4459118977665f681017e1299933895d54b6e87b, 81e6b51709da162b94e40a445bb60856406beaa1, 322b70b522abe03cd59712bb47a72eddd835d19d, 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e, 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e, 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e, 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e, 7fc2172ad4e701d3c6e7dcb7b2efd8df71d2417b, 1c90a357cef4219cb436e59cc7463888103e104b, 4.14.248, 4.19.208, 5.4.149, 5.10.69, 4.9.284, 5.14.8unaffected
LinuxLinux5.15, 0, 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.54, 6.5.4, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.