CVE-2023-52861

What it actually does

The vulnerability is a NULL pointer dereference in the it66121 DRM bridge driver, triggered when the sound framework requests EDID information without a connected monitor or attached connector.

Why it matters to the business

Systems using affected Linux kernel versions with IT66121 hardware may experience crashes or unavailability when audio applications are used without a display connected, leading to potential service disruptions.

How an attack unfolds

An attacker with local access opens the sound card from userspace on a system where no monitor is connected to the IT66121 bridge, causing the kernel to dereference a NULL connector pointer and crash.

How to fix it

Update the Linux kernel to include commit 2c80c4f0d2845645f41cbb7c9304c8efbdbd4331 or apply the equivalent fix in the it66121 driver to return an empty EDID buffer instead of dereferencing NULL.

How to confirm the fix worked

Verify the kernel source includes the fix commit or test by opening sound devices without a connected monitor to ensure no crash occurs.

Typical attack path

1. Gain local user access to the system
2. Ensure no monitor is connected to the IT66121 display bridge
3. Open the sound card device from userspace
4. Trigger the EDID request in the audio subsystem

How to detect it

Check kernel logs for NULL pointer dereference errors involving it66121 or drm bridge when audio is accessed; look for system crashes without monitor connection.

• it66121
• drm_bridge_connector
• NULL pointer dereference

What your security team should do

• Apply the kernel patch immediately if using affected hardware
• Monitor for kernel oops related to it66121
• Restrict local access where possible until patched