CVE-2023-54066

What it actually does

Null pointer dereference in gl861_i2c_master_xfer when user-controlled msg[i].buf is null and msg[i].len is zero, bypassing prior buf checks and crashing on msg[i].buf[0] access.

Why it matters to the business

Kernel crashes or system instability on Linux hosts using affected DVB-USB hardware, causing denial of service and potential loss of media or device functionality until reboot.

How an attack unfolds

An attacker supplies crafted I2C transfer messages with null buffers and zero lengths through the userspace interface; the driver passes earlier sanity checks and dereferences the null pointer, triggering a crash. No known threat actors or ransomware use reported.

How to fix it

Update the kernel to include the added msg[i].len check (see analogous commit 0ed554fd769a). For matejgradisar/open5gs (GIT) deployments, upgrade to commit 5467da9763c300520f56bfbe0a7f5a7f980ec2f6.

How to confirm the fix worked

Confirm the len check is present before any buf[0] access in gl861_i2c_master_xfer; test with zero-length null-buffer messages to ensure no crash occurs.

Typical attack path

1. Locate Linux system exposing the gl861 DVB-USB driver
2. Craft malicious i2c_msg structures with null buf and zero len
3. Invoke gl861_i2c_master_xfer via the device interface
4. Trigger null dereference and kernel panic

How to detect it

Search kernel logs for oops or panic messages mentioning gl861_i2c_master_xfer or null pointer dereference during i2c transfers; inspect USB device probe events for gl861.

• gl861_i2c_master_xfer
• null-ptr-deref in gl861
• msg[i].buf is null and msg[i].len is zero

What your security team should do

• Prioritize kernel updates on all systems exposing DVB-USB gl861 hardware
• Restrict unprivileged access to i2c and USB device nodes until patched
• Monitor for kernel oops or null-deref panics referencing gl861_i2c_master_xfer