184 lines
11 KiB
JSON
184 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53545",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-10-04T15:14:15.920Z",
|
|
"datePublished": "2025-10-04T15:16:53.452Z",
|
|
"dateUpdated": "2026-08-05T09:14:44.686Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:14:44.686Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: unmap and remove csa_va properly\n\nRoot PD BO should be reserved before unmap and remove\na bo_va from VM otherwise lockdep will complain.\n\nv2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian)\n\n[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]\n[14616.937096] Call Trace:\n[14616.937097] <TASK>\n[14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]\n[14616.937187] drm_file_free+0x1d6/0x300 [drm]\n[14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm]\n[14616.937220] drm_release+0x5e/0x100 [drm]\n[14616.937234] __fput+0x9f/0x280\n[14616.937239] ____fput+0xe/0x20\n[14616.937241] task_work_run+0x61/0x90\n[14616.937246] exit_to_user_mode_prepare+0x215/0x220\n[14616.937251] syscall_exit_to_user_mode+0x2a/0x60\n[14616.937254] do_syscall_64+0x48/0x90\n[14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code runs in the DRM file release path (`close()`/process exit on /dev/dri/renderD* → drm_release → amdgpu_driver_postclose_kms), which requires a local file descriptor on the GPU device node. There is no remote or adjacent-network path to this code.\nAC:L - Triggering the unlocked amdgpu_vm_bo_del() requires nothing more than closing the DRM fd, and the attacker controls both sides of the resulting race — one thread submits faulting GPU work or VRAM eviction pressure (driving amdgpu_vm_handle_fault/amdgpu_vm_bo_invalidate under the root PD reservation) while another loops open/close. On SR-IOV VFs the CSA path is taken with stock settings, requiring no special tuning.\nPR:L - Only an unprivileged local user with access to the DRM render node is needed — these are group-accessible on ordinary distributions and available to every app on Android; no capability check exists on the path from drm_release to amdgpu_driver_postclose_kms.\nUI:N - The attacker performs the fd close and the concurrent GPU submissions entirely within their own process; no victim action is involved.\nS:U - Corruption is confined to the guest/host kernel that owns the amdgpu VM; even on an SR-IOV virtual function the VF remains constrained by host GPU/IOMMU isolation, so no security authority is crossed.\nC:H - Unlocked removal from the vm->va interval tree and vm->freed list racing with locked traversals leaves freed amdgpu_bo_va_mapping objects reachable, and corrupted GPU page-table updates map DMA-visible memory, yielding an arbitrary-read primitive over kernel memory.\nI:H - The same rb-tree/list corruption and use-after-free on mapping structures provide a write primitive, and because the affected structures drive GPU PTE programming, an attacker can influence which physical memory the GPU is allowed to write.\nA:H - The path contains an explicit BUG_ON() plus the dma_resv_assert_held() WARN reported in the commit — the latter panics outright under panic_on_warn — and the underlying race produces oopses from torn interval-tree state on every fd close."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c",
|
|
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h",
|
|
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
|
|
"lessThan": "1bc35e637a81dac5f5155e83a277c26708c4d4d7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
|
|
"lessThan": "ae325b245208394279a1dc412c831ebd71befb0d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
|
|
"lessThan": "a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
|
|
"lessThan": "5daff15cd013422bc6d1efcfe82b586800025384",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c",
|
|
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h",
|
|
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.209",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.167",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4.12",
|
|
"lessThanOrEqual": "6.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.5",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "5.15.209"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "6.1.167"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "6.4.12"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2",
|
|
"versionEndExcluding": "6.5"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1bc35e637a81dac5f5155e83a277c26708c4d4d7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ae325b245208394279a1dc412c831ebd71befb0d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5daff15cd013422bc6d1efcfe82b586800025384"
|
|
}
|
|
],
|
|
"title": "drm/amdgpu: unmap and remove csa_va properly",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |