CVE-2023-53991

Root

Cause In the Linux kernel's DRM MSM DPU driver, when a topology requests resources (such as DSC blocks) that are not present in the system's configuration (dpu_mdss_cfg), the corresponding resource pointer in the global state remains NULL. The function dpu_rm_get_assigned_resources then returns an array containing these NULL pointers, expecting valid pointers. This leads to a null-pointer dereference when the caller attempts to use them.

Attack

Surface An attacker who can influence the topology configuration (e.g., through a malicious display mode or crafted input) could trigger this code path. The vulnerability is local, requiring access to the DRM subsystem or the ability to trigger resource allocation. No authentication is mentioned, but it likely requires local user access or root privileges to manipulate DRM state.

Impact

A null-pointer dereference in this context typically results in a hard-to-debug platform lockup or kernel panic, leading to a denial of service. The system becomes unresponsive, requiring a reboot. There is no information about arbitrary code execution, but the crash itself is a security issue.

Mitigation

The fix ensures that num_blks does not increase past NULL blocks, printing an error and breaking out of the loop instead. The patched code prevents returning NULL pointers. The fix is included in stable kernel updates. Administrators should apply the latest kernel updates to their systems.