CVE-2023-53748

What it actually does

User-supplied *nplanes value (1-8) bypasses bounds check against q_data->fmt->num_planes (limited to 1-3), enabling out-of-bounds array access during decoder queue_setup.

Why it matters to the business

May cause crashes, memory corruption, or code execution in video decoding paths on affected Linux systems, increasing risk of service disruption or compromise in media processing workloads.

How an attack unfolds

An attacker invokes the relevant system call with an oversized nplanes argument to reach the unchecked array indexing inside the mediatek vcodec decoder path, leading to memory corruption that can be leveraged for further attacks.

How to fix it

Apply the upstream fix that validates *nplanes against the actual array size before indexing. Upgrade affected packages to the listed fixed versions where available; otherwise backport the bounds check into the vcodec decoder queue_setup function.

How to confirm the fix worked

Confirm the patch is present by inspecting the queue_setup implementation for an explicit bounds comparison of *nplanes before the loop over fmt->num_planes, and verify the running kernel version matches a fixed release.

Typical attack path

1. Locate a system running an unpatched kernel with the mediatek vcodec decoder enabled
2. Prepare a malicious system call supplying nplanes value between 4 and 8
3. Trigger decoder queue_setup via media framework
4. Exploit resulting out-of-bounds write or read for privilege escalation or denial of service

How to detect it

Review kernel logs and audit trails for unusual media decoder queue_setup calls or crashes with array index errors; correlate with process activity involving vcodec or mediatek drivers.

What your security team should do

• Prioritize patching kernels that expose the mediatek vcodec decoder to untrusted input
• Monitor EPSS and exploit maturity indicators for any rise in observed attempts
• Restrict access to media decoding syscalls from unprivileged processes until updated