CVE-2023-53087 (GCVE-0-2023-53087)
Vulnerability from cvelistv5
Published
2025-05-02 15:55
Modified
2026-08-05 09:12
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. Root cause analysis pointed at an issue in barrier processing code -- a race among perf open / close replacing active barriers with perf requests on kernel context and concurrent barrier preallocate / acquire operations performed during user context first pin / last unpin. When adding a request to a composite tracker, we try to reuse an existing fence tracker, already allocated and registered with that composite. The tracker we obtain may already track another fence, may be an idle barrier, or an active barrier. If the tracker we get occurs a non-idle barrier then we try to delete that barrier from a list of barrier tasks it belongs to. However, while doing that we don't respect return value from a function that performs the barrier deletion. Should the deletion ever fail, we would end up reusing the tracker still registered as a barrier task. Since the same structure field is reused with both fence callback lists and barrier tasks list, list corruptions would likely occur. Barriers are now deleted from a barrier tasks list by temporarily removing the list content, traversing that content with skip over the node to be deleted, then populating the list back with the modified content. Should that intentionally racy concurrent deletion attempts be not serialized, one or more of those may fail because of the list being temporary empty. Related code that ignores the results of barrier deletion was initially introduced in v5.4 by commit d8af05ff38ae ("drm/i915: Allow sharing the idle-barrier from other kernel requests"). However, all users of the barrier deletion routine were apparently serialized at that time, then the issue didn't exhibit itself. Results of git bisect with help of a newly developed igt@gem_barrier_race@remote-request IGT test indicate that list corruptions might start to appear after commit 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles"), introduced in v5.5. Respect results of barrier deletion attempts -- mark the barrier as idle only if successfully deleted from the list. Then, before proceeding with setting our fence as the one currently tracked, make sure that the tracker we've got is not a non-idle barrier. If that check fails then don't use that tracker but go back and try to acquire a new, usable one. v3: use unlikely() to document what outcome we expect (Andi), - fix bad grammar in commit description. v2: no code changes, - blame commit 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles"), v5.5, not commit d8af05ff38ae ("drm/i915: Allow sharing the idle-barrier from other kernel requests"), v5.4, - reword commit description. (cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)
References
Impacted products
Vendor Product Version
Linux Linux Version: 311770173fac27845a3a83e2c16100a54d308f72
Version: 311770173fac27845a3a83e2c16100a54d308f72
Version: 311770173fac27845a3a83e2c16100a54d308f72
Version: 311770173fac27845a3a83e2c16100a54d308f72
Version: 311770173fac27845a3a83e2c16100a54d308f72
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_active.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e784a7d07af42057c0576fb647b482f4cb0dc2c",
              "status": "affected",
              "version": "311770173fac27845a3a83e2c16100a54d308f72",
              "versionType": "git"
            },
            {
              "lessThan": "6ab7d33617559cced63d467928f478ea5c459021",
              "status": "affected",
              "version": "311770173fac27845a3a83e2c16100a54d308f72",
              "versionType": "git"
            },
            {
              "lessThan": "5c7591b8574c52c56b3994c2fbef1a3a311b5715",
              "status": "affected",
              "version": "311770173fac27845a3a83e2c16100a54d308f72",
              "versionType": "git"
            },
            {
              "lessThan": "9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff",
              "status": "affected",
              "version": "311770173fac27845a3a83e2c16100a54d308f72",
              "versionType": "git"
            },
            {
              "lessThan": "e0e6b416b25ee14716f3549e0cbec1011b193809",
              "status": "affected",
              "version": "311770173fac27845a3a83e2c16100a54d308f72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_active.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.176",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.104",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.21",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.8",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/active: Fix misuse of non-idle barriers as fence trackers\n\nUsers reported oopses on list corruptions when using i915 perf with a\nnumber of concurrently running graphics applications.  Root cause analysis\npointed at an issue in barrier processing code -- a race among perf open /\nclose replacing active barriers with perf requests on kernel context and\nconcurrent barrier preallocate / acquire operations performed during user\ncontext first pin / last unpin.\n\nWhen adding a request to a composite tracker, we try to reuse an existing\nfence tracker, already allocated and registered with that composite.  The\ntracker we obtain may already track another fence, may be an idle barrier,\nor an active barrier.\n\nIf the tracker we get occurs a non-idle barrier then we try to delete that\nbarrier from a list of barrier tasks it belongs to.  However, while doing\nthat we don\u0027t respect return value from a function that performs the\nbarrier deletion.  Should the deletion ever fail, we would end up reusing\nthe tracker still registered as a barrier task.  Since the same structure\nfield is reused with both fence callback lists and barrier tasks list,\nlist corruptions would likely occur.\n\nBarriers are now deleted from a barrier tasks list by temporarily removing\nthe list content, traversing that content with skip over the node to be\ndeleted, then populating the list back with the modified content.  Should\nthat intentionally racy concurrent deletion attempts be not serialized,\none or more of those may fail because of the list being temporary empty.\n\nRelated code that ignores the results of barrier deletion was initially\nintroduced in v5.4 by commit d8af05ff38ae (\"drm/i915: Allow sharing the\nidle-barrier from other kernel requests\").  However, all users of the\nbarrier deletion routine were apparently serialized at that time, then the\nissue didn\u0027t exhibit itself.  Results of git bisect with help of a newly\ndeveloped igt@gem_barrier_race@remote-request IGT test indicate that list\ncorruptions might start to appear after commit 311770173fac (\"drm/i915/gt:\nSchedule request retirement when timeline idles\"), introduced in v5.5.\n\nRespect results of barrier deletion attempts -- mark the barrier as idle\nonly if successfully deleted from the list.  Then, before proceeding with\nsetting our fence as the one currently tracked, make sure that the tracker\nwe\u0027ve got is not a non-idle barrier.  If that check fails then don\u0027t use\nthat tracker but go back and try to acquire a new, usable one.\n\nv3: use unlikely() to document what outcome we expect (Andi),\n  - fix bad grammar in commit description.\nv2: no code changes,\n  - blame commit 311770173fac (\"drm/i915/gt: Schedule request retirement\n    when timeline idles\"), v5.5, not commit d8af05ff38ae (\"drm/i915: Allow\n    sharing the idle-barrier from other kernel requests\"), v5.4,\n  - reword commit description.\n\n(cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local i915 DRM ioctls on render/primary nodes (GEM execbuf context pin/unpin, I915_PERF_OPEN, and Gen11 SSEU setparam \u2192 intel_context_prepare_remote_request), not via network or adjacent-link protocols.\nAC:L - The attacker controls both sides of the race\u2014concurrent barrier preallocate/acquire via context pin/unpin and replace_barrier via perf open/close or kernel remote requests (e.g. SSEU)\u2014and can retry until ____active_del_barrier fails while the tracker is still reused.\nPR:L - Render-node GEM and (on Gen11) SSEU reconfigure need only ordinary DRM/render access; single-context OA is also unprivileged on Haswell/some Gen12 paths, with no real root or init-namespace admin capability required.\nUI:N - The attacker opens the DRM device and drives concurrent GEM/perf/SSEU operations themselves; no separate victim action is required.\nS:U - List corruption and resulting kernel memory corruption stay within the host i915/kernel authority; there is no VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - Failed barrier deletion still overlays fence cb_list on the same active_node field still linked in barrier_tasks, corrupting kernel lists; groomed heap reuse of that corruption yields disclosure primitives comparable to other list/UAF memory bugs.\nI:H - Corrupted list_head/llist dual-use feeds __list_del and dma_fence callback walks, enabling classic linked-list write-what-where and attacker-influenced callback invocation for control-flow hijack.\nA:H - Users and IGT gem_barrier_race@remote-request observed oopses from list corruptions; even without full exploitation the race reliably crashes the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:42.371Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e784a7d07af42057c0576fb647b482f4cb0dc2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ab7d33617559cced63d467928f478ea5c459021"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c7591b8574c52c56b3994c2fbef1a3a311b5715"
        },
        {
          "url": "https://git.kernel.org/stable/c/9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0e6b416b25ee14716f3549e0cbec1011b193809"
        }
      ],
      "title": "drm/i915/active: Fix misuse of non-idle barriers as fence trackers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53087",
    "datePublished": "2025-05-02T15:55:34.204Z",
    "dateReserved": "2025-05-02T15:51:43.551Z",
    "dateUpdated": "2026-08-05T09:12:42.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.