CVE-2023-53388

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Clean dangling pointer on bind error path

mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/36aa8c61af55675ed967900fbe5deb32d776f051
• https://git.kernel.org/stable/c/49cf87919daeeeeeb9e924c39bdd9203af434461
• https://git.kernel.org/stable/c/6a89ddee1686a8872384aaa9f0bcfa6b675acd86
• https://git.kernel.org/stable/c/7b551a501fa714890e55bae73efede1185728d72
• https://git.kernel.org/stable/c/9a48f99aa7bea15e0b1d8b0040c46b4792eddf3b
• https://git.kernel.org/stable/c/a161f1d92aabb3b8463f752bdc3474dc3a5ec0e5
• https://git.kernel.org/stable/c/f3887c771576c5d740c5c5b8bf654a8ab8020b7d