LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54093: media: anysee: fix null-ptr-deref in anysee_master_xfer

In the Linux kernel, the following vulnerability has been resolved: media: anysee: fix null-ptr-deref in anysee_master_xfer In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") [hverkuil: add spaces around +]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can let malformed Anysee DVB USB driver input crash the kernel through a null pointer dereference. The business risk is mainly service disruption on systems using or exposing that driver path, not confirmed data theft or remote compromise.

Executive priority

Handle through normal kernel patch management, with higher priority for systems using DVB USB hardware or shared environments where a local crash has operational impact. No source here supports emergency treatment for internet-wide exploitation.

Technical view

The bug is in anysee_master_xfer. A user-controlled I2C message can pass earlier buffer checks when msg[i].buf is null and msg[i].len is zero, then later dereference msg[i].buf[0]. Kernel stable commits add a length check to prevent the crash.

Likely exposure

Exposure appears limited to Linux systems with the Anysee media/DVB USB driver present and reachable. The bundle lists affected Linux kernel lines from 2.6.27 through pre-fix stable versions including 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, and 6.5.5.

Exploitation context

The source bundle does not cite active exploitation, public weaponization, CVSS, or KEV listing. The described impact is a kernel crash through malformed user-controlled message data reaching the driver, so treat exploitation evidence as incomplete.

Researcher notes

The core condition is null buf with zero len bypassing earlier checks before msg[i].buf[0] access. Sources name only crash prevention by length validation; they do not establish privilege requirements, reachable interfaces, CVSS, or confirmed exploit activity.

Mitigation direction

  • Upgrade to a Linux kernel containing the referenced stable fix commits.
  • Prioritize systems using Anysee DVB USB or media driver functionality.
  • Check distribution vendor advisories for packaged kernel fix status.
  • Restrict unnecessary local access to affected media/DVB device paths.
  • Disable unused Anysee driver support where operationally acceptable.

Validation and detection

  • Inventory Linux kernel versions across affected systems.
  • Check whether the Anysee media/DVB USB driver is built or loaded.
  • Confirm installed kernels include the relevant stable backport commit.
  • Review vendor kernel changelogs for CVE-2023-54093 coverage.
  • Verify no business-critical host depends on an unfixed exposed driver path.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54093 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61b, a51e34dd6080d8d5c9e95a4e0292cd4cb889a61bunaffected
LinuxLinux2.6.27, 0, 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.