CVE-2023-52888

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52888
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Only free buffer VA that is not NULL In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called only when the buffer to free exists, there are some instances that didn't do the check and triggered warnings in practice. We believe those checks were forgotten unintentionally. Add the checks back to fix the warnings.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04 Patch
https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91 Patch
https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32 Patch
https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04 Patch
https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91 Patch
https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Oct 2025, 16:04

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-415
References () https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04 - () https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04 - Patch
References () https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91 - () https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91 - Patch
References () https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32 - () https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 08:40

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04 - () https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04 -
References () https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91 - () https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91 -
References () https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32 - () https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32 -

30 Jul 2024, 13:32

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: mediatek: vcodec: Solo libera el búfer VA que no es NULL En el controlador MediaTek vcodec, mientras que mtk_vcodec_mem_free() se llama principalmente solo cuando el búfer a liberar existe, hay algunas casos que no hicieron la verificación y activaron advertencias en la práctica. Creemos que esos cheques se olvidaron sin querer. Vuelva a agregar las comprobaciones para corregir las advertencias.

30 Jul 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-30 08:15

Updated : 2025-10-07 16:04

NVD link : CVE-2023-52888

Mitre link : CVE-2023-52888

CVE.ORG link : CVE-2023-52888

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free