CVE-2023-54116

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

drm/fbdev-generic: prohibit potential out-of-bounds access

The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-generic. For example, run fbdev test on a x86+ast2400 platform, with 1680x1050 resolution, will cause the linux kernel hang with the following call trace:

The is because damage rectangles computed by drm_fb_helper_memory_range_to_clip() function is not guaranteed to be bound in the screen's active display area. Possible reasons are:

For example, on a 16KB page size system, in order to store a 1920x1080 XRGB framebuffer, we need allocate 507 pages. Unfortunately, the size 1920*1080*4 can not be divided exactly by 16KB.

Leer descripción completaMostrar menos

1920 * 1080 * 4 = 8294400 bytes 506 * 16 * 1024 = 8290304 bytes 507 * 16 * 1024 = 8306688 bytes

line_length = 1920*4 = 7680 bytes

507 * 16 * 1024 / 7680 = 1081.6

off / line_length = 507 * 16 * 1024 / 7680 = 1081 DIV_ROUND_UP(507 * 16 * 1024, 7680) will yeild 1082

memcpy_toio() typically issue the copy line by line, when copy the last line, out-of-bound access will be happen. Because:

1082 * line_length = 1082 * 7680 = 8309760, and 8309760 > 8306688

Note that userspace may still write to the invisiable area if a larger buffer than width x stride is exposed. But it is not a big issue as long as there still have memory resolve the access if not drafting so far.

- Also limit the y1 (Daniel) - keep fix patch it to minimal (Daniel) - screen_size is page size aligned because of it need mmap (Thomas) - Adding fixes tag (Thomas)

Detalles técnicos trazas, registros y código del informe original

  Oops: 0000 [#1] PREEMPT SMP PTI
  [IGT] fbdev: starting subtest eof
  Workqueue: events drm_fb_helper_damage_work [drm_kms_helper]
  [IGT] fbdev: starting subtest nullptr

  RIP: 0010:memcpy_erms+0xa/0x20
  RSP: 0018:ffffa17d40167d98 EFLAGS: 00010246
  RAX: ffffa17d4eb7fa80 RBX: ffffa17d40e0aa80 RCX: 00000000000014c0
  RDX: 0000000000001a40 RSI: ffffa17d40e0b000 RDI: ffffa17d4eb80000
  RBP: ffffa17d40167e20 R08: 0000000000000000 R09: ffff89522ecff8c0
  R10: ffffa17d4e4c5000 R11: 0000000000000000 R12: ffffa17d4eb7fa80
  R13: 0000000000001a40 R14: 000000000000041a R15: ffffa17d40167e30
  FS:  0000000000000000(0000) GS:ffff895257380000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffffa17d40e0b000 CR3: 00000001eaeca006 CR4: 00000000001706e0
  Call Trace:
   <TASK>
   ? drm_fbdev_generic_helper_fb_dirty+0x207/0x330 [drm_kms_helper]
   drm_fb_helper_damage_work+0x8f/0x170 [drm_kms_helper]
   process_one_work+0x21f/0x430
   worker_thread+0x4e/0x3c0
   ? __pfx_worker_thread+0x10/0x10
   kthread+0xf4/0x120
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x2c/0x50
   </TASK>
  CR2: ffffa17d40e0b000
  ---[ end trace 0000000000000000 ]---

1) Buffers are allocated in the granularity of page size, for mmap system
   call support. The shadow screen buffer consumed by fbdev emulation may
   also choosed be page size aligned.

2) The DIV_ROUND_UP() used in drm_fb_helper_memory_range_to_clip()
   will introduce off-by-one error.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.16%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1499.004 Application or System Exploitationimpact75 %
Impacto secundarioT1561.002 Disk Structure Wipeimpact65 %

Vulnerabilidad de acceso local (AV:L/PR:L) en el kernel Linux sin interacción requerida que permite acceso fuera de límites en la memoria, causando cuelgue del kernel (DoS). El ataque requiere privilegios locales para escribir en el buffer de fbdev y lleva a degradación del servicio de dispositivos

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Filter Network Traffic Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-54116",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "aa15c677cc34e626789cb65b8e7375180851c03b",
              "lessThan": "efd2821b8abeccb6b51423002e2a62921481a26e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aa15c677cc34e626789cb65b8e7375180851c03b",
              "lessThan": "251653fa974ea551a15d16cacfed7cde68cc7f87",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aa15c677cc34e626789cb65b8e7375180851c03b",
              "lessThan": "c8687694bb1f5c48134f152f8c5c2e53483eb99d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/drm_fb_helper.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.3.*"
            },
            {
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/drm_fb_helper.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T13:16:13.533",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/251653fa974ea551a15d16cacfed7cde68cc7f87",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c8687694bb1f5c48134f152f8c5c2e53483eb99d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/efd2821b8abeccb6b51423002e2a62921481a26e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fbdev-generic: prohibit potential out-of-bounds access\n\nThe fbdev test of IGT may write after EOF, which lead to out-of-bound\naccess for drm drivers with fbdev-generic. For example, run fbdev test\non a x86+ast2400 platform, with 1680x1050 resolution, will cause the\nlinux kernel hang with the following call trace:\n\n  Oops: 0000 [#1] PREEMPT SMP PTI\n  [IGT] fbdev: starting subtest eof\n  Workqueue: events drm_fb_helper_damage_work [drm_kms_helper]\n  [IGT] fbdev: starting subtest nullptr\n\n  RIP: 0010:memcpy_erms+0xa/0x20\n  RSP: 0018:ffffa17d40167d98 EFLAGS: 00010246\n  RAX: ffffa17d4eb7fa80 RBX: ffffa17d40e0aa80 RCX: 00000000000014c0\n  RDX: 0000000000001a40 RSI: ffffa17d40e0b000 RDI: ffffa17d4eb80000\n  RBP: ffffa17d40167e20 R08: 0000000000000000 R09: ffff89522ecff8c0\n  R10: ffffa17d4e4c5000 R11: 0000000000000000 R12: ffffa17d4eb7fa80\n  R13: 0000000000001a40 R14: 000000000000041a R15: ffffa17d40167e30\n  FS:  0000000000000000(0000) GS:ffff895257380000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffffa17d40e0b000 CR3: 00000001eaeca006 CR4: 00000000001706e0\n  Call Trace:\n   <TASK>\n   ? drm_fbdev_generic_helper_fb_dirty+0x207/0x330 [drm_kms_helper]\n   drm_fb_helper_damage_work+0x8f/0x170 [drm_kms_helper]\n   process_one_work+0x21f/0x430\n   worker_thread+0x4e/0x3c0\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0xf4/0x120\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x2c/0x50\n   </TASK>\n  CR2: ffffa17d40e0b000\n  ---[ end trace 0000000000000000 ]---\n\nThe is because damage rectangles computed by\ndrm_fb_helper_memory_range_to_clip() function is not guaranteed to be\nbound in the screen's active display area. Possible reasons are:\n\n1) Buffers are allocated in the granularity of page size, for mmap system\n   call support. The shadow screen buffer consumed by fbdev emulation may\n   also choosed be page size aligned.\n\n2) The DIV_ROUND_UP() used in drm_fb_helper_memory_range_to_clip()\n   will introduce off-by-one error.\n\nFor example, on a 16KB page size system, in order to store a 1920x1080\nXRGB framebuffer, we need allocate 507 pages. Unfortunately, the size\n1920*1080*4 can not be divided exactly by 16KB.\n\n 1920 * 1080 * 4 = 8294400 bytes\n 506 * 16 * 1024 = 8290304 bytes\n 507 * 16 * 1024 = 8306688 bytes\n\n line_length = 1920*4 = 7680 bytes\n\n 507 * 16 * 1024 / 7680 = 1081.6\n\n off / line_length = 507 * 16 * 1024 / 7680 = 1081\n DIV_ROUND_UP(507 * 16 * 1024, 7680) will yeild 1082\n\nmemcpy_toio() typically issue the copy line by line, when copy the last\nline, out-of-bound access will be happen. Because:\n\n 1082 * line_length = 1082 * 7680 = 8309760, and 8309760 > 8306688\n\nNote that userspace may still write to the invisiable area if a larger\nbuffer than width x stride is exposed. But it is not a big issue as\nlong as there still have memory resolve the access if not drafting so\nfar.\n\n - Also limit the y1 (Daniel)\n - keep fix patch it to minimal (Daniel)\n - screen_size is page size aligned because of it need mmap (Thomas)\n - Adding fixes tag (Thomas)"
    }
  ],
  "lastModified": "2026-08-04T10:19:29.647",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}