Out-of-Bounds Access Vulnerability in Linux Kernel's i915 Package
Summary
CVE-2023-53112: In the Linux kernel, the following vulnerability has been resolved: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internal... Affects linux versions < 6.1.25-1. Fixed in 6.1.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. The i915 package is a driver for Intel integrated graphics, enabling the use of Intel GPUs in various devices. This package is crucial for rendering graphics and ensuring optimal performance in systems using Intel hardware. The vulnerability in question exposes the system to potential crashes or unexpected behavior due to improper handling of array indices.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the i915 driver related to the handling of sub-slice information for Intel GPUs. Specifically, a commit introduced an out-of-bounds access issue where the maximum number of sub-slices was incorrectly set, allowing for an index that exceeds the allocated array size. This flaw was reported by UBSAN (Undefined Behavior Sanitizer) and can lead to system instability or crashes, particularly on devices with a Gen 11 i915 graphics card. The vulnerability arises from a mismatch between the expected number of sub-slices and the actual configuration, potentially allowing for memory corruption.
How To Fix
Minimum fixed version
6.1.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the kernel as mentioned above.
Conclusion
The CVE-2023-53112 vulnerability in the Linux kernel's i915 driver poses a significant risk due to out-of-bounds access issues. Users are strongly encouraged to update their systems to the patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53112 is a vulnerability in the Linux kernel's i915 driver that allows for out-of-bounds access, potentially leading to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is advisable to prioritize updating your kernel as soon as possible to mitigate the risk of exploitation.
Exploitation of this vulnerability could lead to system instability, crashes, or unexpected behavior, particularly on systems using Intel Gen 11 graphics.
Detailed information can be found in the official CVE database or by reviewing the Linux kernel changelogs related to the i915 driver.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
