GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52913 (GCVE-0-2023-52913)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-08-05 09:11
VLAI
Title
drm/i915: Fix potential context UAFs
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential context UAFs gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* thing that gem_context_register() does with the ctx pointer. [tursulin: Stable and fixes tags add/tidy.] (cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:34 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eb4dedae920a07c485328af3da2202ec5184fb17 , < ae278887193110dfeb857ea63e243a3851fbb0bc (git)
Affected: eb4dedae920a07c485328af3da2202ec5184fb17 , < b696c627b3f56e173f7f70b8487d66da8ff22506 (git)
Affected: eb4dedae920a07c485328af3da2202ec5184fb17 , < afce71ff6daa9c0f852df0727fe32c6fb107f0fa (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.171 , ≤ 5.15.* (semver)
Unaffected: 6.1.7 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52913",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:42.812004Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:12.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae278887193110dfeb857ea63e243a3851fbb0bc",
              "status": "affected",
              "version": "eb4dedae920a07c485328af3da2202ec5184fb17",
              "versionType": "git"
            },
            {
              "lessThan": "b696c627b3f56e173f7f70b8487d66da8ff22506",
              "status": "affected",
              "version": "eb4dedae920a07c485328af3da2202ec5184fb17",
              "versionType": "git"
            },
            {
              "lessThan": "afce71ff6daa9c0f852df0727fe32c6fb107f0fa",
              "status": "affected",
              "version": "eb4dedae920a07c485328af3da2202ec5184fb17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.171",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential context UAFs\n\ngem_context_register() makes the context visible to userspace, and which\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\nSo we need to ensure that nothing uses the ctx ptr after this.  And we\nneed to ensure that adding the ctx to the xarray is the *last* thing\nthat gem_context_register() does with the ctx pointer.\n\n[tursulin: Stable and fixes tags add/tidy.]\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through local DRM ioctls (I915_GEM_CONTEXT_CREATE_EXT / I915_GEM_CONTEXT_DESTROY) on an i915 render node (/dev/dri/renderD*), not via network or adjacent protocols.\nAC:L - The attacker fully controls both sides of the race by issuing concurrent create and destroy ioctls on the same DRM file from multiple threads, and can retry until the post-xa_store use of ctx wins against context_close.\nPR:L - Both ioctls are marked DRM_RENDER_ALLOW and require only an open render node, which unprivileged local users routinely have on Intel GPU systems (desktop render group, ChromeOS, Android), not real root or init-namespace admin.\nUI:N - Exploitation requires no victim action; the attacker opens the render node and issues the racing ioctls themselves.\nS:U - Impact stays within the host kernel authority as a local privilege-escalation style memory-corruption bug; it does not cross VM, IOMMU, or other security boundaries.\nC:H - This is a use-after-free of struct i915_gem_context (freed via context_close -\u003e kref_put -\u003e kfree_rcu), which per scoring guidance enables reclaim and arbitrary kernel read primitives.\nI:H - The UAF races list_add against list_del/free on ctx client and global context lists, enabling heap corruption and write/control-flow hijack primitives consistent with High integrity impact for UAFs.\nA:H - Use-after-free of the GEM context reliably yields kernel oops/panic or list corruption crashes even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:58.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506"
        },
        {
          "url": "https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa"
        }
      ],
      "title": "drm/i915: Fix potential context UAFs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52913",
    "datePublished": "2024-08-21T06:10:54.540Z",
    "dateReserved": "2024-08-21T06:07:11.017Z",
    "dateUpdated": "2026-08-05T09:11:58.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52913",
      "date": "2026-09-16",
      "epss": "0.00248",
      "percentile": "0.16321"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.8.11\", \"versionEndExcluding\": \"5.9\", \"matchCriteriaId\": \"06BCA914-E4BD-46C7-A8F5-74061C8BC138\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10\", \"versionEndExcluding\": \"6.1.7\", \"matchCriteriaId\": \"7349455C-BBB3-4263-B0EA-BC54BA76B4C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF501633-2F44-4913-A8EE-B021929F49F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915: Fix potential context UAFs\\n\\ngem_context_register() makes the context visible to userspace, and which\\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\\nSo we need to ensure that nothing uses the ctx ptr after this.  And we\\nneed to ensure that adding the ctx to the xarray is the *last* thing\\nthat gem_context_register() does with the ctx pointer.\\n\\n[tursulin: Stable and fixes tags add/tidy.]\\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/i915: corrige posibles UAF de contexto gem_context_register() hace que el contexto sea visible para el espacio de usuario, y en qu\\u00e9 punto un hilo separado puede activar el ioctl I915_GEM_CONTEXT_DESTROY. Por lo tanto, debemos asegurarnos de que nada use ctx ptr despu\\u00e9s de esto. Y debemos asegurarnos de que agregar ctx al xarray sea lo *\\u00faltimo* que hace gem_context_register() con el puntero ctx. [tursulin: etiquetas estables y corregidas agregadas/ordenadas.] (seleccionado de el commit bed4b455cf5374e68879be56971c1da563bcd90c)\"}]",
      "id": "CVE-2023-52913",
      "lastModified": "2024-11-08T16:15:18.787",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-21T07:15:07.087",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:33:36.000Z",
      "cve": "CVE-2023-52913",
      "id": "msrc_CVE-2023-52913",
      "initial_release_date": "2024-08-02T00:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/i915: Fix potential context UAFs",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2023-52913.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52913\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:07.087\",\"lastModified\":\"2026-08-04T10:18:48.733\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915: Fix potential context UAFs\\n\\ngem_context_register() makes the context visible to userspace, and which\\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\\nSo we need to ensure that nothing uses the ctx ptr after this.  And we\\nneed to ensure that adding the ctx to the xarray is the *last* thing\\nthat gem_context_register() does with the ctx pointer.\\n\\n[tursulin: Stable and fixes tags add/tidy.]\\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/i915: corrige posibles UAF de contexto gem_context_register() hace que el contexto sea visible para el espacio de usuario, y en qu\u00e9 punto un hilo separado puede activar el ioctl I915_GEM_CONTEXT_DESTROY. Por lo tanto, debemos asegurarnos de que nada use ctx ptr despu\u00e9s de esto. Y debemos asegurarnos de que agregar ctx al xarray sea lo *\u00faltimo* que hace gem_context_register() con el puntero ctx. [tursulin: etiquetas estables y corregidas agregadas/ordenadas.] (seleccionado de el commit bed4b455cf5374e68879be56971c1da563bcd90c)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/i915/gem/i915_gem_context.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eb4dedae920a07c485328af3da2202ec5184fb17\",\"lessThan\":\"ae278887193110dfeb857ea63e243a3851fbb0bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb4dedae920a07c485328af3da2202ec5184fb17\",\"lessThan\":\"b696c627b3f56e173f7f70b8487d66da8ff22506\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb4dedae920a07c485328af3da2202ec5184fb17\",\"lessThan\":\"afce71ff6daa9c0f852df0727fe32c6fb107f0fa\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/i915/gem/i915_gem_context.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.171\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.7\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:34:42.812004Z\",\"id\":\"CVE-2023-52913\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8.11\",\"versionEndExcluding\":\"5.9\",\"matchCriteriaId\":\"06BCA914-E4BD-46C7-A8F5-74061C8BC138\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"6.1.7\",\"matchCriteriaId\":\"7349455C-BBB3-4263-B0EA-BC54BA76B4C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:24:39+00:00",
      "cve": "CVE-2023-52913",
      "id": "CVE-2023-52913",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915: Fix potential context UAFs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52913.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:25:05Z",
      "cve": "CVE-2023-52913",
      "id": "CVE-2023-52913",
      "initial_release_date": "2024-08-22T03:14:27Z",
      "product_status:known_affected": "372",
      "product_status:known_not_affected": "214",
      "product_status:recommended": "288",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52913",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52913.json",
      "version": "40"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52913\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:34:42.812004Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.084Z\"}}], \"cna\": {\"title\": \"drm/i915: Fix potential context UAFs\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is triggered through local DRM ioctls (I915_GEM_CONTEXT_CREATE_EXT / I915_GEM_CONTEXT_DESTROY) on an i915 render node (/dev/dri/renderD*), not via network or adjacent protocols.\\nAC:L - The attacker fully controls both sides of the race by issuing concurrent create and destroy ioctls on the same DRM file from multiple threads, and can retry until the post-xa_store use of ctx wins against context_close.\\nPR:L - Both ioctls are marked DRM_RENDER_ALLOW and require only an open render node, which unprivileged local users routinely have on Intel GPU systems (desktop render group, ChromeOS, Android), not real root or init-namespace admin.\\nUI:N - Exploitation requires no victim action; the attacker opens the render node and issues the racing ioctls themselves.\\nS:U - Impact stays within the host kernel authority as a local privilege-escalation style memory-corruption bug; it does not cross VM, IOMMU, or other security boundaries.\\nC:H - This is a use-after-free of struct i915_gem_context (freed via context_close -\u003e kref_put -\u003e kfree_rcu), which per scoring guidance enables reclaim and arbitrary kernel read primitives.\\nI:H - The UAF races list_add against list_del/free on ctx client and global context lists, enabling heap corruption and write/control-flow hijack primitives consistent with High integrity impact for UAFs.\\nA:H - Use-after-free of the GEM context reliably yields kernel oops/panic or list corruption crashes even when not fully exploited for code execution.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"eb4dedae920a07c485328af3da2202ec5184fb17\", \"lessThan\": \"ae278887193110dfeb857ea63e243a3851fbb0bc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eb4dedae920a07c485328af3da2202ec5184fb17\", \"lessThan\": \"b696c627b3f56e173f7f70b8487d66da8ff22506\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eb4dedae920a07c485328af3da2202ec5184fb17\", \"lessThan\": \"afce71ff6daa9c0f852df0727fe32c6fb107f0fa\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/i915/gem/i915_gem_context.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.171\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/i915/gem/i915_gem_context.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ae278887193110dfeb857ea63e243a3851fbb0bc\"}, {\"url\": \"https://git.kernel.org/stable/c/b696c627b3f56e173f7f70b8487d66da8ff22506\"}, {\"url\": \"https://git.kernel.org/stable/c/afce71ff6daa9c0f852df0727fe32c6fb107f0fa\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915: Fix potential context UAFs\\n\\ngem_context_register() makes the context visible to userspace, and which\\npoint a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.\\nSo we need to ensure that nothing uses the ctx ptr after this.  And we\\nneed to ensure that adding the ctx to the xarray is the *last* thing\\nthat gem_context_register() does with the ctx pointer.\\n\\n[tursulin: Stable and fixes tags add/tidy.]\\n(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.171\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.7\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:58.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52913\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:58.161Z\", \"dateReserved\": \"2024-08-21T06:07:11.017Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:54.540Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.