CVE-2023-52847

What it actually does

Race condition between bttv_irq_timeout timer callback and bttv_remove allows use-after-free when kfree(btv) occurs without del_timer_sync, permitting the timeout handler to dereference a freed btv structure.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems using the bttv driver, increasing downtime and security risk for media capture hardware deployments; low exploitability reduces immediate urgency.

How an attack unfolds

An attacker triggers bttv_probe to arm the timer, then forces bttv_remove (via module unload or device removal) to free the structure while the timer remains pending, so a subsequent bttv_irq_timeout invocation accesses the dangling pointer.

How to fix it

Apply the upstream fix by upgrading the Linux kernel to include commit bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9, which adds del_timer_sync in the bttv_remove function.

How to confirm the fix worked

Inspect bttv driver source for del_timer_sync call in remove path; confirm running kernel contains commit bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9 or later equivalent.

Typical attack path

1. Load bttv module and trigger probe to arm timeout timer
2. Initiate device removal or module unload to call kfree(btv) without timer deletion
3. Allow timer to fire and execute bttv_irq_timeout on freed memory

How to detect it

Search kernel logs and crash dumps for references to bttv_irq_timeout or bttv_remove around use-after-free or oops events; monitor for unexpected module unload sequences involving bttv.

• bttv_irq_timeout
• bttv_remove
• kfree(btv)
• bttv_set_dma

What your security team should do

• Prioritize kernel upgrade to the fixed commit on systems exposing bttv hardware
• Disable bttv module if video capture is unused
• Review kernel logs for bttv-related oops or use-after-free warnings