CVE-2023-54047

Vulnerability

A use-after-free vulnerability exists in the Linux kernel's drm/rockchip dw_hdmi driver. The DRM encoder is embedded within the rockchip_hdmi structure, which is allocated as part of a component. During unbind (e.g., when removing the module), the component memory is freed before the main DRM device is destroyed, allowing access to freed memory [1].

Exploitation

To exploit this, an attacker would need to trigger the unbind operation, such as by running rmmod on the driver or through hot-unplug events. This typically requires local access to the system and the ability to load/unload kernel modules. No special privileges beyond local user access are mentioned, but the attack surface is limited to systems using the Rockchip DRM driver.

Impact

A use-after-free in kernel memory can lead to system crashes (denial of service) or potentially allow an attacker to execute arbitrary code with kernel privileges. The specific impact depends on the attacker's ability to control the freed memory contents.

Mitigation

The fix is included in the Linux kernel stable tree, as referenced in the commit that moves encoder cleanup above clock disabling, similar to the bind-error path [1]. Users are advised to update their kernels to include this patch.