{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54116", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.519Z", "datePublished": "2025-12-24T13:06:37.591Z", "dateUpdated": "2026-08-05T09:17:21.332Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:21.332Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fbdev-generic: prohibit potential out-of-bounds access\n\nThe fbdev test of IGT may write after EOF, which lead to out-of-bound\naccess for drm drivers with fbdev-generic. For example, run fbdev test\non a x86+ast2400 platform, with 1680x1050 resolution, will cause the\nlinux kernel hang with the following call trace:\n\n Oops: 0000 [#1] PREEMPT SMP PTI\n [IGT] fbdev: starting subtest eof\n Workqueue: events drm_fb_helper_damage_work [drm_kms_helper]\n [IGT] fbdev: starting subtest nullptr\n\n RIP: 0010:memcpy_erms+0xa/0x20\n RSP: 0018:ffffa17d40167d98 EFLAGS: 00010246\n RAX: ffffa17d4eb7fa80 RBX: ffffa17d40e0aa80 RCX: 00000000000014c0\n RDX: 0000000000001a40 RSI: ffffa17d40e0b000 RDI: ffffa17d4eb80000\n RBP: ffffa17d40167e20 R08: 0000000000000000 R09: ffff89522ecff8c0\n R10: ffffa17d4e4c5000 R11: 0000000000000000 R12: ffffa17d4eb7fa80\n R13: 0000000000001a40 R14: 000000000000041a R15: ffffa17d40167e30\n FS: 0000000000000000(0000) GS:ffff895257380000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffa17d40e0b000 CR3: 00000001eaeca006 CR4: 00000000001706e0\n Call Trace:\n \n ? drm_fbdev_generic_helper_fb_dirty+0x207/0x330 [drm_kms_helper]\n drm_fb_helper_damage_work+0x8f/0x170 [drm_kms_helper]\n process_one_work+0x21f/0x430\n worker_thread+0x4e/0x3c0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xf4/0x120\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n \n CR2: ffffa17d40e0b000\n ---[ end trace 0000000000000000 ]---\n\nThe is because damage rectangles computed by\ndrm_fb_helper_memory_range_to_clip() function is not guaranteed to be\nbound in the screen's active display area. Possible reasons are:\n\n1) Buffers are allocated in the granularity of page size, for mmap system\n call support. The shadow screen buffer consumed by fbdev emulation may\n also choosed be page size aligned.\n\n2) The DIV_ROUND_UP() used in drm_fb_helper_memory_range_to_clip()\n will introduce off-by-one error.\n\nFor example, on a 16KB page size system, in order to store a 1920x1080\nXRGB framebuffer, we need allocate 507 pages. Unfortunately, the size\n1920*1080*4 can not be divided exactly by 16KB.\n\n 1920 * 1080 * 4 = 8294400 bytes\n 506 * 16 * 1024 = 8290304 bytes\n 507 * 16 * 1024 = 8306688 bytes\n\n line_length = 1920*4 = 7680 bytes\n\n 507 * 16 * 1024 / 7680 = 1081.6\n\n off / line_length = 507 * 16 * 1024 / 7680 = 1081\n DIV_ROUND_UP(507 * 16 * 1024, 7680) will yeild 1082\n\nmemcpy_toio() typically issue the copy line by line, when copy the last\nline, out-of-bound access will be happen. Because:\n\n 1082 * line_length = 1082 * 7680 = 8309760, and 8309760 > 8306688\n\nNote that userspace may still write to the invisiable area if a larger\nbuffer than width x stride is exposed. But it is not a big issue as\nlong as there still have memory resolve the access if not drafting so\nfar.\n\n - Also limit the y1 (Daniel)\n - keep fix patch it to minimal (Daniel)\n - screen_size is page size aligned because of it need mmap (Thomas)\n - Adding fixes tag (Thomas)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through local access to the fbdev emulation node (`write()` or `mmap()` on `/dev/fb0`), which dispatches into `drm_fb_helper_sys_write()`/`drm_fb_helper_deferred_io()`. There is no network or remote input path into the damage-clipping code.\nAC:L - The attacker simply writes to (or dirties the last mmap page of) the tail of the framebuffer; on any configuration where the page-aligned screen buffer is not an exact multiple of `line_length` — common with typical resolutions, larger page sizes, or multi-head/overallocated surfaces — the out-of-bounds scanline copy occurs deterministically and can be repeated at will.\nPR:L - No capability check exists on the path; `fb_write()` gates only on file permissions, so any unprivileged user holding a `/dev/fb0` descriptor (video-group member, logind seat user via uaccess ACL, Android/kiosk graphics process) can trigger it. Real root in the initial namespace is not required.\nUI:N - The attacker performs the write or mmap dirtying itself and the damage worker fires from a kernel workqueue; no victim action or interaction is needed.\nS:U - The out-of-bounds read and write stay within the kernel's own memory and the DRM buffer objects it manages, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The blit reads a full extra scanline (up to `line_length`, i.e. multiple kilobytes) of adjacent kernel memory past the end of the vmalloc'd shadow buffer — far more than a \"few bytes\" — and copies that kernel data into the scanout framebuffer, disclosing it via the display and the client buffer object.\nI:H - The same off-by-one drives `iosys_map_memcpy_to()` one scanline past the end of the destination client buffer/VRAM mapping, an out-of-bounds write of kernel-memory contents that corrupts memory beyond the mapped BO.\nA:H - The reported result is a kernel oops/hang — a page fault in `memcpy_erms` inside `drm_fb_helper_damage_work` in workqueue context — which an unprivileged local user can trigger repeatedly to crash the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/drm_fb_helper.c" ], "versions": [ { "version": "aa15c677cc34e626789cb65b8e7375180851c03b", "lessThan": "efd2821b8abeccb6b51423002e2a62921481a26e", "status": "affected", "versionType": "git" }, { "version": "aa15c677cc34e626789cb65b8e7375180851c03b", "lessThan": "251653fa974ea551a15d16cacfed7cde68cc7f87", "status": "affected", "versionType": "git" }, { "version": "aa15c677cc34e626789cb65b8e7375180851c03b", "lessThan": "c8687694bb1f5c48134f152f8c5c2e53483eb99d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/drm_fb_helper.c" ], "versions": [ { "version": "5.18", "status": "affected" }, { "version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/efd2821b8abeccb6b51423002e2a62921481a26e" }, { "url": "https://git.kernel.org/stable/c/251653fa974ea551a15d16cacfed7cde68cc7f87" }, { "url": "https://git.kernel.org/stable/c/c8687694bb1f5c48134f152f8c5c2e53483eb99d" } ], "title": "drm/fbdev-generic: prohibit potential out-of-bounds access", "x_generator": { "engine": "bippy-1.2.0" } } } }