{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53378", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-17T14:54:09.735Z", "datePublished": "2025-09-18T13:33:23.905Z", "dateUpdated": "2026-08-05T09:13:46.218Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:13:46.218Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dpt: Treat the DPT BO as a framebuffer\n\nCurrently i915_gem_object_is_framebuffer() doesn't treat the\nBO containing the framebuffer's DPT as a framebuffer itself.\nThis means eg. that the shrinker can evict the DPT BO while\nleaving the actual FB BO bound, when the DPT is allocated\nfrom regular shmem.\n\nThat causes an immediate oops during hibernate as we\ntry to rewrite the PTEs inside the already evicted\nDPT obj.\n\nTODO: presumably this might also be the reason for the\nDPT related display faults under heavy memory pressure,\nbut I'm still not sure how that would happen as the object\nshould be pinned by intel_dpt_pin() while in active use by\nthe display engine...\n\n(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached via local i915 display/GEM and system-suspend/resume (`intel_dpt_suspend`/`intel_dpt_resume` rewriting DPT PTEs), not via network protocols or adjacent-link frames.\nAC:L - An attacker can create tiled Gen13+ framebuffers (forcing smem DPT when stolen is exhausted), induce memory pressure so the shrinker reclaims the unpinned volatile DPT BO, then trigger suspend/resume; no race or layout outside attacker influence is required.\nPR:L - ADDFB2 needs only an unprivileged DRM primary-node open (typically video-group access), and suspend can be initiated by an active local session via logind without real root or init-namespace CAP_SYS_ADMIN.\nUI:N - The attacker can create the reclaimable DPT state and initiate suspend/resume themselves; no separate victim action is required.\nS:U - Impact is a same-kernel use-after-free of DPT backing pages within the host i915 authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After shrinker put_pages, resume still writeqs through the stale `dpt->iomem` mapping of freed pages—a UAF that can be reclaimed and leveraged for arbitrary kernel disclosure.\nI:H - The same dangling `dpt->iomem` UAF performs PTE writeqs into recycled pages, yielding a heap corruption/write primitive exploitable for control-flow hijacking.\nA:H - Rewriting PTEs in an already-evicted DPT object causes an immediate kernel oops during hibernate/resume (and related display faults under memory pressure), denying service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/display/intel_dpt.c", "drivers/gpu/drm/i915/gem/i915_gem_object.h", "drivers/gpu/drm/i915/gem/i915_gem_object_types.h" ], "versions": [ { "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0", "lessThan": "c781c107731fc09ce4330c8c636b8446d0f72aa4", "status": "affected", "versionType": "git" }, { "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0", "lessThan": "5390a02b4508416b9bee96674f141c68f89bafbc", "status": "affected", "versionType": "git" }, { "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0", "lessThan": "3413881e1ecc3cba722a2e87ec099692eed5be28", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/display/intel_dpt.c", "drivers/gpu/drm/i915/gem/i915_gem_object.h", "drivers/gpu/drm/i915/gem/i915_gem_object_types.h" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.23", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.10", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.2.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c781c107731fc09ce4330c8c636b8446d0f72aa4" }, { "url": "https://git.kernel.org/stable/c/5390a02b4508416b9bee96674f141c68f89bafbc" }, { "url": "https://git.kernel.org/stable/c/3413881e1ecc3cba722a2e87ec099692eed5be28" } ], "title": "drm/i915/dpt: Treat the DPT BO as a framebuffer", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2023-53378", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2026-01-14T18:55:32.767182Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:03:03.870Z" } } ] } }