LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54143: media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init() If we encounter any error in the vdec_msg_queue_init() then we need to set "msg_queue->wdma_addr.size = 0;". Normally, this is done inside the vdec_msg_queue_deinit() function. However, if the first call to allocate &msg_queue->wdma_addr fails, then the vdec_msg_queue_deinit() function is a no-op. For that situation, just set the size to zero explicitly and return. There were two other error paths which did not clean up before returning. Change those error paths to goto mem_alloc_err.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in MediaTek video decoder queue initialization. Some error paths failed to clean up allocated resources, creating a resource leak. The sources do not provide CVSS, CWE, impact detail, or exploitation evidence. Business urgency depends on whether deployed Linux kernels include the MediaTek vcodec driver and the affected code.

Executive priority

Treat as targeted kernel maintenance unless MediaTek-based Linux devices are business-critical or internet-managed. There is no cited exploitation or severity score, but kernel resource leaks should still be tracked through normal patch governance.

Technical view

The fix changes vdec_msg_queue_init() in the MediaTek vcodec driver so failed allocation paths reset msg_queue->wdma_addr.size and route cleanup through the existing deinit path. The public record identifies Linux kernel versions and stable commits, but does not define a CVSS score, CWE, privilege requirement, or security boundary impact.

Likely exposure

Likely limited to Linux systems using kernels with the affected MediaTek vcodec code, especially MediaTek-based devices or builds enabling that media driver. Generic Linux servers without this driver path may not be exposed, but the source bundle does not provide configuration-level applicability details.

Exploitation context

No active exploitation is stated in the source bundle, and KEV is false. The available evidence describes a resource leak on initialization error paths, not a public exploit, weaponized technique, or confirmed attack campaign.

Researcher notes

The evidence is narrow: a resolved Linux kernel resource-leak bug with four stable commit references. Missing data includes CVSS, CWE, exploitability conditions, reachable attack surface, and exact downstream distro status. Avoid extrapolating beyond MediaTek vcodec initialization error handling.

Mitigation direction

  • Review vendor or distribution kernel advisories for CVE-2023-54143.
  • Update to a kernel containing the referenced stable fix commits.
  • Prioritize MediaTek-based Linux devices and custom kernel builds.
  • Confirm whether the MediaTek vcodec driver is built or loaded.
  • Track downstream backports rather than relying only on version strings.

Validation and detection

  • Inventory Linux kernel versions across MediaTek-based devices.
  • Check downstream kernel changelogs for the referenced fix commits.
  • Verify whether the MediaTek vcodec driver is enabled in builds.
  • Review asset telemetry for devices using affected kernel branches.
  • Document any systems awaiting vendor-fixed kernel packages.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54143 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb199fe46f35c57a415acd4d5295b0f4e35048c11, b199fe46f35c57a415acd4d5295b0f4e35048c11, b199fe46f35c57a415acd4d5295b0f4e35048c11, b199fe46f35c57a415acd4d5295b0f4e35048c11unaffected
LinuxLinux5.18, 0, 6.1.53, 6.4.16, 6.5.3, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.