CVE-2023-53378 (GCVE-0-2023-53378)
Vulnerability from cvelistv5
Published
2025-09-18 13:33
Modified
2026-08-05 09:13
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem. That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj. TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine... (cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)
References
Impacted products
Vendor Product Version
Linux Linux Version: 0dc987b699ce4266450d407d6d79d41eab88c5d0
Version: 0dc987b699ce4266450d407d6d79d41eab88c5d0
Version: 0dc987b699ce4266450d407d6d79d41eab88c5d0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:55:32.767182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:03:03.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_dpt.c",
            "drivers/gpu/drm/i915/gem/i915_gem_object.h",
            "drivers/gpu/drm/i915/gem/i915_gem_object_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c781c107731fc09ce4330c8c636b8446d0f72aa4",
              "status": "affected",
              "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0",
              "versionType": "git"
            },
            {
              "lessThan": "5390a02b4508416b9bee96674f141c68f89bafbc",
              "status": "affected",
              "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0",
              "versionType": "git"
            },
            {
              "lessThan": "3413881e1ecc3cba722a2e87ec099692eed5be28",
              "status": "affected",
              "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_dpt.c",
            "drivers/gpu/drm/i915/gem/i915_gem_object.h",
            "drivers/gpu/drm/i915/gem/i915_gem_object_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.23",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dpt: Treat the DPT BO as a framebuffer\n\nCurrently i915_gem_object_is_framebuffer() doesn\u0027t treat the\nBO containing the framebuffer\u0027s DPT as a framebuffer itself.\nThis means eg. that the shrinker can evict the DPT BO while\nleaving the actual FB BO bound, when the DPT is allocated\nfrom regular shmem.\n\nThat causes an immediate oops during hibernate as we\ntry to rewrite the PTEs inside the already evicted\nDPT obj.\n\nTODO: presumably this might also be the reason for the\nDPT related display faults under heavy memory pressure,\nbut I\u0027m still not sure how that would happen as the object\nshould be pinned by intel_dpt_pin() while in active use by\nthe display engine...\n\n(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached via local i915 display/GEM and system-suspend/resume (`intel_dpt_suspend`/`intel_dpt_resume` rewriting DPT PTEs), not via network protocols or adjacent-link frames.\nAC:L - An attacker can create tiled Gen13+ framebuffers (forcing smem DPT when stolen is exhausted), induce memory pressure so the shrinker reclaims the unpinned volatile DPT BO, then trigger suspend/resume; no race or layout outside attacker influence is required.\nPR:L - ADDFB2 needs only an unprivileged DRM primary-node open (typically video-group access), and suspend can be initiated by an active local session via logind without real root or init-namespace CAP_SYS_ADMIN.\nUI:N - The attacker can create the reclaimable DPT state and initiate suspend/resume themselves; no separate victim action is required.\nS:U - Impact is a same-kernel use-after-free of DPT backing pages within the host i915 authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After shrinker put_pages, resume still writeqs through the stale `dpt-\u003eiomem` mapping of freed pages\u2014a UAF that can be reclaimed and leveraged for arbitrary kernel disclosure.\nI:H - The same dangling `dpt-\u003eiomem` UAF performs PTE writeqs into recycled pages, yielding a heap corruption/write primitive exploitable for control-flow hijacking.\nA:H - Rewriting PTEs in an already-evicted DPT object causes an immediate kernel oops during hibernate/resume (and related display faults under memory pressure), denying service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:46.218Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c781c107731fc09ce4330c8c636b8446d0f72aa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5390a02b4508416b9bee96674f141c68f89bafbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3413881e1ecc3cba722a2e87ec099692eed5be28"
        }
      ],
      "title": "drm/i915/dpt: Treat the DPT BO as a framebuffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53378",
    "datePublished": "2025-09-18T13:33:23.905Z",
    "dateReserved": "2025-09-17T14:54:09.735Z",
    "dateUpdated": "2026-08-05T09:13:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53378\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:55:32.767182Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:55:28.752Z\"}}], \"cna\": {\"title\": \"drm/i915/dpt: Treat the DPT BO as a framebuffer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached via local i915 display/GEM and system-suspend/resume (`intel_dpt_suspend`/`intel_dpt_resume` rewriting DPT PTEs), not via network protocols or adjacent-link frames.\\nAC:L - An attacker can create tiled Gen13+ framebuffers (forcing smem DPT when stolen is exhausted), induce memory pressure so the shrinker reclaims the unpinned volatile DPT BO, then trigger suspend/resume; no race or layout outside attacker influence is required.\\nPR:L - ADDFB2 needs only an unprivileged DRM primary-node open (typically video-group access), and suspend can be initiated by an active local session via logind without real root or init-namespace CAP_SYS_ADMIN.\\nUI:N - The attacker can create the reclaimable DPT state and initiate suspend/resume themselves; no separate victim action is required.\\nS:U - Impact is a same-kernel use-after-free of DPT backing pages within the host i915 authority; it does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - After shrinker put_pages, resume still writeqs through the stale `dpt-\u003eiomem` mapping of freed pages\\u2014a UAF that can be reclaimed and leveraged for arbitrary kernel disclosure.\\nI:H - The same dangling `dpt-\u003eiomem` UAF performs PTE writeqs into recycled pages, yielding a heap corruption/write primitive exploitable for control-flow hijacking.\\nA:H - Rewriting PTEs in an already-evicted DPT object causes an immediate kernel oops during hibernate/resume (and related display faults under memory pressure), denying service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0dc987b699ce4266450d407d6d79d41eab88c5d0\", \"lessThan\": \"c781c107731fc09ce4330c8c636b8446d0f72aa4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0dc987b699ce4266450d407d6d79d41eab88c5d0\", \"lessThan\": \"5390a02b4508416b9bee96674f141c68f89bafbc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0dc987b699ce4266450d407d6d79d41eab88c5d0\", \"lessThan\": \"3413881e1ecc3cba722a2e87ec099692eed5be28\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/i915/display/intel_dpt.c\", \"drivers/gpu/drm/i915/gem/i915_gem_object.h\", \"drivers/gpu/drm/i915/gem/i915_gem_object_types.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/i915/display/intel_dpt.c\", \"drivers/gpu/drm/i915/gem/i915_gem_object.h\", \"drivers/gpu/drm/i915/gem/i915_gem_object_types.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c781c107731fc09ce4330c8c636b8446d0f72aa4\"}, {\"url\": \"https://git.kernel.org/stable/c/5390a02b4508416b9bee96674f141c68f89bafbc\"}, {\"url\": \"https://git.kernel.org/stable/c/3413881e1ecc3cba722a2e87ec099692eed5be28\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/dpt: Treat the DPT BO as a framebuffer\\n\\nCurrently i915_gem_object_is_framebuffer() doesn\u0027t treat the\\nBO containing the framebuffer\u0027s DPT as a framebuffer itself.\\nThis means eg. that the shrinker can evict the DPT BO while\\nleaving the actual FB BO bound, when the DPT is allocated\\nfrom regular shmem.\\n\\nThat causes an immediate oops during hibernate as we\\ntry to rewrite the PTEs inside the already evicted\\nDPT obj.\\n\\nTODO: presumably this might also be the reason for the\\nDPT related display faults under heavy memory pressure,\\nbut I\u0027m still not sure how that would happen as the object\\nshould be pinned by intel_dpt_pin() while in active use by\\nthe display engine...\\n\\n(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.23\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2.10\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:13:46.218Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-53378\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:13:46.218Z\", \"dateReserved\": \"2025-09-17T14:54:09.735Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-18T13:33:23.905Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.