CVE-2023-52589

What it actually does

Race condition in rkisp1_isp_stop and rkisp1_csi_disable allows the interrupt handler to continue executing after interrupt masking and device power-off, leading to register accesses on disabled hardware and potential board lockup.

Why it matters to the business

Systems using Rockchip ISP hardware for camera or media capture can experience sudden crashes or freezes during streaming stop operations, increasing downtime and support costs in affected embedded and Linux deployments.

How an attack unfolds

An attacker with local access triggers concurrent media streaming stop and interrupt handling paths in the rkisp1 driver, causing the handler to access powered-off ISP registers and induce a system lockup; no widespread active exploitation observed despite generic kernel UAF mentions.

How to fix it

Update the Linux kernel to the fixed commit bf808f58681cab64c81cd814551814fd34e540fe or later stable releases containing the patch; rebuild and deploy kernel images for all affected distributions.

How to confirm the fix worked

Confirm kernel source contains the IRQ disable race fix in rkisp1_isp_stop and rkisp1_csi_disable; test media capture stop sequences under load to verify absence of lockups.

Typical attack path

1. Obtain local code execution or shell on target Linux system
2. Initiate media capture via rkisp1 driver interfaces
3. Trigger concurrent stop/disable paths while handler is active
4. Exploit timing window to access disabled hardware registers
5. Induce board lockup or crash

How to detect it

Review kernel logs for rkisp1-related crashes or lockups during media streaming shutdown; inspect dmesg and syslog for register access errors after ISP disable calls.

What your security team should do

• Prioritize kernel upgrades on all Rockchip-based systems within standard patch windows
• Monitor for downstream dependent packages and rebuild images accordingly
• Add regression tests for concurrent start/stop operations in media drivers