{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54186", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.497Z", "datePublished": "2025-12-30T12:08:55.882Z", "dateUpdated": "2026-08-05T09:17:53.517Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:53.517Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: fix pin_assignment_show\n\nThis patch fixes negative indexing of buf array in pin_assignment_show\nwhen get_current_pin_assignments returns 0 i.e. no compatible pin\nassignments are found.\n\nBUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c\n...\nCall trace:\ndump_backtrace+0x110/0x204\ndump_stack_lvl+0x84/0xbc\nprint_report+0x358/0x974\nkasan_report+0x9c/0xfc\n__do_kernel_fault+0xd4/0x2d4\ndo_bad_area+0x48/0x168\ndo_tag_check_fault+0x24/0x38\ndo_mem_abort+0x6c/0x14c\nel1_abort+0x44/0x68\nel1h_64_sync_handler+0x64/0xa4\nel1h_64_sync+0x78/0x7c\npin_assignment_show+0x26c/0x33c\ndev_attr_show+0x50/0xc0" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The out-of-bounds write executes inside a sysfs `show` handler invoked by an ordinary local `read(2)` on `/sys/class/typec/port*-partner/*/displayport/pin_assignment`. The USB-C DisplayPort partner whose VDO produces a zero pin-assignment mask is a normal steady-state system condition (docked laptop, DP-source accessory), not the attack action itself.\nAC:L - No race, no unpredictable memory state is required — the attacker simply reads the world-readable attribute and can repeat the read arbitrarily many times to groom the kmalloc-cg-4k slab and place a chosen neighbor before the seq_file buffer. The triggering condition (`get_current_pin_assignments()` returning 0) is deterministic for the attached partner and was hit by real production hardware.\nPR:L - The attribute is created with `DEVICE_ATTR_RW` (mode 0644) and the affected versions have no `is_visible` callback, so any unprivileged local account can read it with no capability, namespace, or group membership required.\nUI:N - Exploitation needs only the attacker's own `read()` syscall against a persistently present sysfs file; no victim must open, mount, or configure anything. On ChromeOS/Android the same read is additionally performed automatically by system daemons on partner registration.\nS:U - The corruption is kernel heap memory damaged by kernel code, confined to the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The write corrupts the final byte of an adjacent, attacker-groomable 4K slab object; overwriting a length, count, or index field in a neighboring structure converts this into out-of-bounds reads and kernel memory disclosure. Per kernel scoring guidance, heap memory corruption leveragable for information disclosure is scored High.\nI:H - This is a genuine heap out-of-bounds write (`buf[-1] = '\\n'`) into a neighboring slab allocation the attacker can select via heap grooming; single-byte heap overflows of this class have historically been escalated to arbitrary write and privilege escalation. Out-of-bounds writes are scored High.\nA:H - The originating report is a kernel fault — an arm64 MTE tag-check fault taken in `pin_assignment_show()` leading to an oops — and KASAN builds panic on the same access. On production kernels the silent corruption of an adjacent 4K slab object causes crashes, and the trigger can be repeated indefinitely by an unprivileged user." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/typec/altmodes/displayport.c" ], "versions": [ { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2", "status": "affected", "versionType": "git" }, { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "4f9c0a7c272626cb6716ffc7800e8c73260cdce6", "status": "affected", "versionType": "git" }, { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "ff466f77d0a56719979c4234abd412abd98eae8f", "status": "affected", "versionType": "git" }, { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "fc0e18f95c88435bd8a1ceb540243cd7fbcd9781", "status": "affected", "versionType": "git" }, { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "08bd1be1c716fd50a7df48f82dcbc59a103082b5", "status": "affected", "versionType": "git" }, { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "54ee23e4ab263a495ace1eed43d3883212ece17f", "status": "affected", "versionType": "git" }, { "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588", "lessThan": "d8f28269dd4bf9b55c3fb376ae31512730a96fce", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/usb/typec/altmodes/displayport.c" ], "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.284", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.244", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.181", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.113", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.30", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.4", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "4.19.284" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.244" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.181" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.3.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2" }, { "url": "https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6" }, { "url": "https://git.kernel.org/stable/c/ff466f77d0a56719979c4234abd412abd98eae8f" }, { "url": "https://git.kernel.org/stable/c/fc0e18f95c88435bd8a1ceb540243cd7fbcd9781" }, { "url": "https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5" }, { "url": "https://git.kernel.org/stable/c/54ee23e4ab263a495ace1eed43d3883212ece17f" }, { "url": "https://git.kernel.org/stable/c/d8f28269dd4bf9b55c3fb376ae31512730a96fce" } ], "title": "usb: typec: altmodes/displayport: fix pin_assignment_show", "x_generator": { "engine": "bippy-1.2.0" } } } }