CVE-2023-23004

What it actually does

The driver incorrectly treats a non-NULL error pointer returned by get_sg_table as a valid scatter-gather table, leading to subsequent use of an invalid pointer and memory corruption or kernel crash.

Why it matters to the business

Local users on affected systems can trigger denial of service, disrupting graphics workloads or entire hosts until reboot; low exploitation probability limits widespread operational risk.

How an attack unfolds

An attacker with local access loads or interacts with the malidp DRM driver in a way that causes get_sg_table to return an error pointer; the flawed error check then dereferences the pointer, corrupting memory or panicking the kernel.

How to fix it

Upgrade the Linux kernel to commit 15342f930ebebcfe36f2415049736a77d7d2e045 or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 15342f930ebebcfe36f2415049736a77d7d2e045; inspect drivers/gpu/drm/arm/malidp_planes.c for the corrected error-pointer check; run targeted DRM plane allocation tests under error conditions.

Typical attack path

1. Obtain local user or process execution on a Linux system using the ARM Mali-DP DRM driver
2. Trigger the malidp plane initialization or buffer-mapping code path that calls get_sg_table
3. Force get_sg_table to return an error pointer instead of NULL
4. Observe kernel crash or memory corruption from subsequent pointer misuse

How to detect it

Review kernel logs for oops or panic messages originating from malidp_planes.c; search audit or system logs for unusual DRM plane allocation failures immediately preceding crashes.

What your security team should do

• Prioritize kernel upgrades on systems exposing the malidp DRM driver
• Monitor kernel update channels for backports to supported distribution kernels
• Restrict unprivileged local access where graphics acceleration is unnecessary