Data Corruption Vulnerability in Linux Kernel - AMD Graphics Driver
Summary
CVE-2023-53009: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add sync after creating vram bo There will be data corruption on vram allocated by svm if the initialization is not complete and application... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system, including device drivers, system calls, and process management. The AMD graphics driver (drm/amdkfd) is responsible for managing AMD GPU resources and enabling graphics processing. This vulnerability affects the driver by potentially leading to data corruption in video RAM (vram) allocated by the SVM (Shared Virtual Memory) if the initialization process is incomplete.
Vulnerability Detail
The vulnerability identified as CVE-2023-53009 arises from a failure to synchronize memory operations after creating video RAM (vram) buffer objects (BO) in the AMD graphics driver. If an application attempts to write to the memory before the initialization is complete, it can lead to data corruption. This issue is critical as it may result in unpredictable behavior of applications relying on the AMD GPU, potentially leading to crashes or data loss.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to ensure that applications do not write to vram until the initialization process is confirmed to be complete.
Conclusion
CVE-2023-53009 is a critical vulnerability in the Linux kernel's AMD graphics driver that can lead to data corruption if not addressed. Users are strongly encouraged to update their systems to the patched version to mitigate risks. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53009 is a vulnerability in the Linux kernel's AMD graphics driver that can lead to data corruption in video RAM if initialization is incomplete.
Users of the Linux kernel with AMD graphics hardware, particularly those using Debian versions 11, 12, and 13, may be affected.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without any signup.
The consequences include potential data corruption, application crashes, and unpredictable behavior when writing to vram allocated by SVM.
Yes, a patch is available in the form of updated Linux kernel packages. Users should upgrade to version 6.1.11-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.