CVE-2023-53851

Vulnerability

Description

CVE-2023-53851 is a use-after-free vulnerability in the Linux kernel's DRM MSM DP controller. The issue arises from incorrect resource cleanup ordering: using devres to depopulate the aux bus tied the cleanup to the DRM device (drm_dev->dev), which may be torn down after the DP controller. This causes the auxiliary devices (e.g., eDP panel) to be freed while still in use, particularly during probe deferral or component unbind.

Exploitation

An attacker could trigger this vulnerability by causing a probe deferral or unbind of the DP controller, leading to a scenario where the auxiliary bus devices are accessed after the DP controller resources are freed. For instance, reading the EDID via the aux bus could access freed memory, resulting in corrupted data (e.g., EDID hexdump of zeros) or a KASAN-detected use-after-free.

Impact

The primary impact is a use-after-free condition, which can lead to system crashes, memory corruption, or potential privilege escalation if exploited. The vulnerability can be triggered locally by an authenticated user with sufficient privileges to cause device probe/deferral cycles.

Mitigation

The fix is to explicitly depopulate the aux bus in the error and component unbind paths, ensuring that auxiliary devices are cleaned up before the DP controller resources are freed. Patches are available in the stable kernel commits [1] and [2]. Users should update to the latest stable kernel version containing these commits.