Critical GPU Hang Issue in Linux Kernel's AMDGPU Package
Summary
CVE-2023-53036: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix call trace warning and hang when removing amdgpu device On GPUs with RAS enabled, below call trace and hang are observed when shutting d... Affects linux versions < 6.1.25-1. Fixed in 6.1.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The AMDGPU package is responsible for managing AMD graphics processing units (GPUs) within the Linux environment, enabling advanced graphics rendering and performance optimization. This package is crucial for users relying on AMD hardware for gaming, graphic design, and other GPU-intensive applications. However, it has been identified that certain versions of this package are vulnerable to a critical issue that can lead to system hangs during device shutdown, particularly on GPUs with Reliability, Availability, and Serviceability (RAS) features enabled.
Vulnerability Detail
The vulnerability, identified as CVE-2023-53036, arises from a flaw in the AMDGPU driver where a call trace warning and system hang occur when attempting to remove the amdgpu device. This issue is particularly problematic during the shutdown process of the device, leading to potential data loss and system instability. The root cause of the vulnerability is linked to improper handling of device state flags, which can result in memory wipe during the shutdown stage, thereby affecting the overall reliability of the system.
How To Fix
Minimum fixed version
6.1.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid shutting down or removing the amdgpu device until the system is updated to a patched version.
Conclusion
The CVE-2023-53036 vulnerability in the Linux kernel's AMDGPU package poses significant risks to system stability and data integrity. Users are strongly encouraged to update their systems to the patched version to avoid potential issues. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software environment.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53036 is a vulnerability in the Linux kernel's AMDGPU driver that can cause system hangs during device shutdown.
This vulnerability can lead to system instability and potential data loss when shutting down or removing AMD GPUs with RAS features enabled.
You should update your Linux kernel to the fixed version 6.1.25-1 or later to mitigate the risks associated with this vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check for vulnerabilities without signing up at the Vulert playground.
Failure to address this vulnerability may result in system hangs, data loss, and overall instability, particularly during device shutdown.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
