CVE-2023-54066

Vulnerability

In the Linux kernel's DVB USB driver for gl861, the function gl861_i2c_master_xfer lacks a sanity check on msg[i].len. When a user-controlled I2C message has a null buf and zero len, earlier checks on buf are bypassed, leading to a null pointer dereference when accessing msg[i].buf[0] [1][2].

Exploitation

An attacker with local access to the system can send malicious I2C messages through the DVB USB device interface. No special privileges beyond the ability to interact with the device are required [1].

Impact

Successful exploitation results in a kernel crash (denial of service). The vulnerability does not appear to allow privilege escalation or arbitrary code execution based on the available information [2].

Mitigation

The fix has been backported to stable kernel trees. Users should update their Linux kernel to a version containing the commit that adds the missing length check [1][2].