CVE-2023-52647

What it actually does

NULL pointer dereference in the imx8-isi crossbar subdev when translating streams to an unconnected sink pad, resulting in kernel crash.

Why it matters to the business

Denial of service on systems using affected NXP i.MX8 media pipelines; requires reboot and may disrupt video capture or processing workloads. Low prevalence outside embedded hardware.

How an attack unfolds

An attacker with local access configures a media pipeline that enables a stream on a crossbar sink pad lacking a remote subdev connection; the driver then accesses the NULL pad without validation and panics the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit c95318607fbe8fdd44991a8dad2e44118e6b8812 or later; apply the NULL check before remote pad access in the imx8-isi driver.

How to confirm the fix worked

Verify the presence of the pad-NULL guard in drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c after update; confirm no oops on stream enable with unconnected sinks; check kernel version against fixed commit.

Typical attack path

1. Obtain local access or user-space media control on affected device
2. Create or modify a media pipeline linking to an unconnected crossbar sink pad
3. Enable streaming on that pad via V4L2 or media controller ioctl
4. Trigger the NULL dereference in stream translation logic
5. Cause kernel panic and system crash

How to detect it

Search kernel logs and dmesg for oops/panic traces mentioning imx8-isi, crossbar, or NULL pointer dereference during media pipeline setup; correlate with media-ctl or v4l2-ctl activity.

• imx8-isi-crossbar
• NULL pointer dereference
• crossbar pad is non-NULL

What your security team should do

• Prioritize kernel upgrade on all devices using imx8-isi media pipelines
• Restrict unprivileged access to media controller and V4L2 devices where possible
• Monitor for kernel oops involving imx8-isi crossbar during testing