CVE-2023-53497

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called()

The vsp1 driver uses the vb2_is_streaming() function in its .buf_queue()

handler to check if the .start_streaming() operation has been called,

and decide whether to just add the buffer to an internal queue, or also

trigger a hardware run. vb2_is_streaming() relies on the vb2_queue

structure's streaming field, which used to be set only after calling the

.start_streaming() operation.

Commit a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops")

changed this, setting the .streaming field in vb2_core_streamon() before

enqueuing buffers to the driver and calling .start_streaming(). This

broke the vsp1 driver which now believes that .start_streaming() has

been called when it hasn't, leading to a crash:

[ 881.058705] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020

[ 881.067495] Mem abort info:

[ 881.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References