CVE-2023-3355

What it actually does

NULL pointer dereference in submit_lookup_cmds caused by missing validation of kmalloc return value, resulting in kernel panic on affected MSM GPU paths.

Why it matters to the business

Local authenticated users can crash Linux systems using MSM graphics hardware, causing denial of service and loss of availability; widespread on servers, desktops, and embedded devices running vulnerable kernels.

How an attack unfolds

An attacker with local user privileges interacts with the DRM subsystem to invoke submit_lookup_cmds under memory pressure, forcing kmalloc to return NULL and triggering the unchecked dereference to crash the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit d839f0811a31322c087a859c2b181e2383daa7be; rebuild and reboot with the patched kernel; restrict unprivileged access to DRM devices via device permissions or cgroups until patched.

How to confirm the fix worked

Confirm the running kernel source tree or binary contains commit d839f0811a31322c087a859c2b181e2383daa7be; inspect dmesg or kernel logs after simulated allocation failure to verify absence of the panic; use kernel version checks or static analysis on msm_gem_submit.c for the added NULL check.

Typical attack path

1. Obtain local shell access on a target Linux system
2. Locate or open DRM device nodes under /dev/dri
3. Issue GPU submit commands that exercise msm_gem_submit.c while inducing allocation failure
4. Trigger NULL dereference and kernel panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing msm_gem_submit.c or submit_lookup_cmds; correlate with user activity on DRM devices; search for repeated allocation failure patterns preceding crashes.

What your security team should do

• Prioritize kernel updates on all systems exposing MSM DRM drivers
• Apply least-privilege access controls to /dev/dri nodes
• Monitor kernel crash logs for msm_gem_submit related panics
• Test patched kernels in staging environments before broad deployment