199 lines
11 KiB
JSON
199 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53753",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-08T01:18:04.279Z",
|
|
"datePublished": "2025-12-08T01:19:13.743Z",
|
|
"dateUpdated": "2026-10-15T21:41:35.356Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:15:50.057Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix mapping to non-allocated address\n\n[Why]\nThere is an issue mapping non-allocated location of memory.\nIt would allocate gpio registers from an array out of bounds.\n\n[How]\nPatch correct numbers of bounds for using."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The amdgpu/DC display stack is a local device driver; the out-of-bounds indexing is reached through driver initialization and DDC/I2C transactions driven by local DRM ioctls on /dev/dri/card* (forced connector probe → drm_get_edid → dc_submit_i2c → dal_ddc_open → define_ddc_registers). There is no network-facing path to this code.\nAC:L - On an affected DCN2/DCN3/DCN3.2 board whose VBIOS maps a DDC/OEM-I2C line to the DC_GPIO_DDCVGA_A pad, en==GPIO_DDC_LINE_DDC_VGA is produced deterministically and the &ddc_shift[6]/&ddc_mask[6] overread happens on every gpio open — no race, no memory-layout grooming, and the attacker can repeat connector probes at will.\nPR:L - An unprivileged local user with a normal DRM/render node handle (video/render group, granted to the active logind session on desktops and to app processes on Android) can force connector detection and EDID/I2C traffic over the affected DDC line; no CAP_SYS_ADMIN or root is required.\nUI:N - The vulnerable path is entered by the driver itself at resource-pool/link init and by any programmatic connector probe or i2c transfer; no victim action such as plugging a monitor or opening a file is needed.\nS:U - The out-of-bounds access and its effects are entirely within the kernel's own security authority (kernel .rodata read plus GPU register programming by the same driver); no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds read of 40 bytes of kernel .rodata beyond the end of ddc_shift[]/ddc_mask[] — well past a \"few bytes\" — and the leaked adjacent kernel constants are consumed as bitfield descriptors whose effect on the GPIO/I2C register state is observable to the caller performing DDC transactions.\nI:H - The out-of-bounds-derived shift and mask values are fed directly into REG_SET/REG_UPDATE read-modify-write sequences against the GPU's DDC GPIO MASK register, so arbitrary unintended bits of live hardware control registers are overwritten with values the driver never validated.\nA:H - Misprogramming the DDC/I2C pad control bits wedges display detection and I2C on that line, and the global-out-of-bounds access plus the resulting out-of-range shift counts trigger KASAN/UBSAN reports that panic the kernel under panic_on_warn, which is standard on hardened and Android builds."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c",
|
|
"drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c",
|
|
"drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c",
|
|
"drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
|
|
"lessThan": "8ce8a443ddd9002861a4ee8a7e33a0c02717422f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
|
|
"lessThan": "24aaf6603600d6d1159973c809ea2737664b28c4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
|
|
"lessThan": "9190d4a263264eabf715f5fc1827da45e3fdc247",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c",
|
|
"drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c",
|
|
"drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c",
|
|
"drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.16",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2.3",
|
|
"lessThanOrEqual": "6.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.1.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.2.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8ce8a443ddd9002861a4ee8a7e33a0c02717422f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/24aaf6603600d6d1159973c809ea2737664b28c4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9190d4a263264eabf715f5fc1827da45e3fdc247"
|
|
}
|
|
],
|
|
"title": "drm/amd/display: fix mapping to non-allocated address",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2023-53753",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:37:00.430443Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:41:35.356Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |