CVE-2023-54284

What it actually does

Missing bounds check on user-supplied u8 value allows calculation of negative length passed to internal repack function in the av7110 media driver.

Why it matters to the business

Systems using the affected Linux media subsystem could experience unexpected behavior or instability when processing certain media streams; low exploitability reduces immediate operational risk.

How an attack unfolds

An attacker supplies a crafted buffer via ts_play() with a buf[4] value large enough to produce a negative length after subtraction; the kernel previously lacked a check before calling the repack routine.

How to fix it

Update the Linux kernel to a version containing commit 6680af5be9f08d830567e9118f76d3e64684db8f or later; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the presence of the added bounds check ensuring len - (buf[4] + 1) - 4 cannot be negative and verify removal of the obsolete if (!len) guard in the write_ts_to_decoder function.

Typical attack path

1. Identify a system exposing the av7110 driver and ts_play interface
2. Craft input buffer with buf[4] set to produce underflow in length calculation
3. Invoke the interface to trigger the negative length path
4. Observe any resulting kernel behavior or crash

How to detect it

Review kernel logs and audit records for unusual calls into av7110_ipack_instant_repack with anomalous length values; no public exploitation artifacts are known.

What your security team should do

• Apply the kernel update containing the referenced commit on all affected systems
• Prioritize systems that actively use the av7110 DVB driver
• Monitor vendor advisories for backported fixes in distribution kernels