{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53806", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-08T23:58:35.276Z", "datePublished": "2025-12-09T00:01:04.413Z", "dateUpdated": "2026-08-05T09:16:08.328Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:08.328Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: populate subvp cmd info only for the top pipe\n\n[Why]\nSystem restart observed while changing the display resolution\nto 8k with extended mode. Sytem restart was caused by a page fault.\n\n[How]\nWhen the driver populates subvp info it did it for both the pipes using\nvblank which caused an outof bounds array access causing the page fault.\nadded checks to allow the top pipe only to fix this issue." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached only through DRM modeset ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on the local `/dev/dri/card0` device node, driving amdgpu's atomic commit into `dcn32_commit_subvp_config()`. There is no network or remote input involved.\nAC:L - A local attacker holding DRM master can repeatedly issue atomic commits with high-resolution/multi-display configurations that force ODM/MPC pipe splits alongside a SubVP stream, deterministically pushing `cmd_pipe_index` past 1. No race or unpredictable memory-layout condition is involved — the overflow is a fixed-offset write that happens every time the pipe topology is hit.\nPR:L - Only an unprivileged local user with access to the DRM primary node is needed — the logged-in console/session user is granted this via logind ACLs (or `video` group membership), and DRM master is obtainable without root. No capability check exists anywhere on the path from the ioctl to `dc_dmub_setup_subvp_dmub_command()`.\nUI:N - The attacker performs the modeset themselves via ioctl; no action by another user or victim is required to reach the overflowing loop.\nS:U - The out-of-bounds write corrupts the kernel's own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Up to 56 bytes of kernel stack beyond the 64-byte `union dmub_rb_cmd` local are overwritten with mode-derived values, corrupting saved registers, pointers, and the return-address region of the caller's frame. Such stack corruption is leverageable to redirect subsequent kernel operations and disclose arbitrary kernel memory.\nI:H - This is an out-of-bounds stack write with partially attacker-influenced content (display timings supplied through the requested modeline), which per kernel scoring practice constitutes a high integrity impact — it can smash the stack canary and return address, giving a path to control-flow hijacking and arbitrary modification of kernel state.\nA:H - The bug was reported as causing a page fault and full system restart when changing to 8K in extended mode; stack smashing reliably produces an oops, stack-protector panic, or hard hang, taking down the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c" ], "versions": [ { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "92e6c79acad4b96efeff261d27bdbd8089a7dd24", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "375d192eb1f1d9229a6d994da7ba31f3582b106b", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/92e6c79acad4b96efeff261d27bdbd8089a7dd24" }, { "url": "https://git.kernel.org/stable/c/375d192eb1f1d9229a6d994da7ba31f3582b106b" }, { "url": "https://git.kernel.org/stable/c/9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0" } ], "title": "drm/amd/display: populate subvp cmd info only for the top pipe", "x_generator": { "engine": "bippy-1.2.0" } } } }