LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53784: drm: bridge: dw_hdmi: fix connector access for scdc

In the Linux kernel, the following vulnerability has been resolved: drm: bridge: dw_hdmi: fix connector access for scdc Commit 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs") changed the scdc interface to pick up an i2c adapter from a connector instead. However, in the case of dw-hdmi, the wrong connector was being used to pass i2c adapter information, since dw-hdmi's embedded connector structure is only populated when the bridge attachment callback explicitly asks for it. drm-meson is handling connector creation, so this won't happen, leading to a NULL pointer dereference. Fix it by having scdc functions access dw-hdmi's current connector pointer instead, which is assigned during the bridge enablement stage. [narmstrong: moved Fixes tag before first S-o-b and added Reported-by tag]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel graphics driver bug that can trigger a NULL pointer dereference in specific HDMI bridge handling. Business impact is most likely service instability on affected systems using the relevant DRM/HDMI path, but the provided sources do not include severity scoring or exploit evidence.

Executive priority

Track as a targeted Linux kernel stability issue, not an emergency internet-scale threat based on current evidence. Patch affected kernel fleets through normal vulnerability management, prioritizing devices that depend on HDMI/DRM functionality.

Technical view

The issue is in drm/bridge/dw_hdmi SCDC handling after commit 5d844091f237 changed SCDC access to derive I2C adapter data from a connector. With drm-meson-created connectors, dw-hdmi could pass the wrong connector state, causing NULL pointer dereference. Stable fixes change SCDC access to use dw-hdmi's current connector pointer.

Likely exposure

Exposure appears limited to Linux systems running the affected kernel code path with dw-hdmi and drm-meson connector handling. The bundle marks Linux kernel versions including 6.4, 6.4.5, and 6.5 as affected, but distribution backport status is not provided.

Exploitation context

The source bundle does not report active exploitation, public exploit availability, or KEV listing. The described failure mode is a NULL pointer dereference in kernel graphics connector handling, so treat exploitation impact as unconfirmed from these sources.

Researcher notes

Key uncertainty is impact scope: the bundle gives no CVSS, CWE, exploit status, or distro-specific fixed versions. Validation should focus on the dw-hdmi SCDC connector path and whether the stable commits are present in deployed kernels.

Mitigation direction

  • Check vendor or distribution advisories for fixed kernel packages.
  • Prioritize systems using affected HDMI/DRM hardware paths.
  • Apply kernel updates that include the referenced stable fixes.
  • If updates are unavailable, monitor vendor guidance for mitigations.

Validation and detection

  • Inventory kernel versions on Linux assets with relevant HDMI/DRM hardware.
  • Check whether dw-hdmi and drm-meson paths are present or loaded.
  • Confirm installed kernels include the referenced stable commits.
  • Review system logs for graphics driver NULL pointer dereference crashes.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53784 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5d844091f2370f01752c3129b147861b9dcd3d98, 5d844091f2370f01752c3129b147861b9dcd3d98unaffected
LinuxLinux6.4, 0, 6.4.5, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.