LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54147: media: platform: mtk-mdp3: Add missing check and free for ida_alloc

In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Add missing check and free for ida_alloc Add the check for the return value of the ida_alloc in order to avoid NULL pointer dereference. Moreover, free allocated "ctx->id" if mdp_m2m_open fails later in order to avoid memory leak.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the MediaTek MDP3 media driver. A missing allocation failure check could cause a kernel NULL pointer dereference, and a related cleanup gap could leak memory. The source bundle does not provide severity scoring, exploit evidence, or business-impact detail.

Executive priority

Handle through normal kernel patch management unless MediaTek media devices are business-critical or exposed to untrusted local users. Escalation is limited by missing severity, no KEV listing, and no exploit evidence in the provided sources.

Technical view

The fix adds return-value handling for ida_alloc and frees ctx->id when later mdp_m2m_open initialization fails. The documented consequences are NULL pointer dereference avoidance and memory leak prevention in media/platform/mtk-mdp3. Affected version data is present but partly ambiguous in the bundle.

Likely exposure

Likely limited to Linux systems running affected kernel versions with the MediaTek MDP3 media platform driver built and reachable. Exposure is probably higher on MediaTek-based devices than general servers, but the bundle does not confirm attack prerequisites.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of active exploitation, public exploit use, or weaponized attack paths. Treat exploitation status as unconfirmed, not active.

Researcher notes

Key unknowns are exploitability, required local privileges, and whether reachable device nodes expose the vulnerable path. Review the referenced commits and downstream backports before assigning severity or declaring specific product exposure.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fixes.
  • Prioritize MediaTek-based systems or kernels with mtk-mdp3 enabled.
  • Check distribution advisories for fixed package versions.
  • Disable unused affected media driver support if vendor-supported.
  • Track backports against the referenced kernel stable commits.

Validation and detection

  • Inventory Linux kernel versions across relevant systems.
  • Identify systems using MediaTek MDP3 hardware or driver support.
  • Compare installed kernels with vendor fixed-version guidance.
  • Review vendor changelogs for the referenced stable commits.
  • Monitor for related kernel crashes or media-driver failures.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54147 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux61890ccaefaff89f5babd2c8412fd222c3f5fe38, 61890ccaefaff89f5babd2c8412fd222c3f5fe38, 61890ccaefaff89f5babd2c8412fd222c3f5fe38, 61890ccaefaff89f5babd2c8412fd222c3f5fe38unaffected
LinuxLinux6.1, 0, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.