CVE-2023-53714

Vulnerability

Details In the Linux kernel's STM LTDC driver, function ltdc_crtc_set_crc_source() dereferenced the struct drm_crtc pointer via container_of() before checking if the pointer is NULL. This leads to a potential null pointer dereference, causing a kernel panic. The issue was identified by a smatch warning [1].

Exploitation

Exploitation requires the ability to call ltdc_crtc_set_crc_source(), typically from a userspace program setting CRC source via DRM ioctls. No authentication beyond normal user access is needed; an unprivileged user could trigger this bug, leading to denial of service.

Impact

An attacker can cause a kernel panic, resulting in system crash and denial of service. No privilege escalation is indicated.

Mitigation

The fix is available in Linux kernel stable trees as a commit that moves the pointer check before the container_of() call [1]. Users should apply the patch or update to a kernel version containing it.