CVE-2023-54186 (GCVE-0-2023-54186)
Vulnerability from cvelistv5
Published
2025-12-30 12:08
Modified
2026-08-05 09:17
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0
References
Impacted products
Vendor Product Version
Linux Linux Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
Version: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/altmodes/displayport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "4f9c0a7c272626cb6716ffc7800e8c73260cdce6",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "ff466f77d0a56719979c4234abd412abd98eae8f",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "fc0e18f95c88435bd8a1ceb540243cd7fbcd9781",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "08bd1be1c716fd50a7df48f82dcbc59a103082b5",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "54ee23e4ab263a495ace1eed43d3883212ece17f",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "d8f28269dd4bf9b55c3fb376ae31512730a96fce",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/altmodes/displayport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.284",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.244",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: fix pin_assignment_show\n\nThis patch fixes negative indexing of buf array in pin_assignment_show\nwhen get_current_pin_assignments returns 0 i.e. no compatible pin\nassignments are found.\n\nBUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c\n...\nCall trace:\ndump_backtrace+0x110/0x204\ndump_stack_lvl+0x84/0xbc\nprint_report+0x358/0x974\nkasan_report+0x9c/0xfc\n__do_kernel_fault+0xd4/0x2d4\ndo_bad_area+0x48/0x168\ndo_tag_check_fault+0x24/0x38\ndo_mem_abort+0x6c/0x14c\nel1_abort+0x44/0x68\nel1h_64_sync_handler+0x64/0xa4\nel1h_64_sync+0x78/0x7c\npin_assignment_show+0x26c/0x33c\ndev_attr_show+0x50/0xc0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds write executes inside a sysfs `show` handler invoked by an ordinary local `read(2)` on `/sys/class/typec/port*-partner/*/displayport/pin_assignment`. The USB-C DisplayPort partner whose VDO produces a zero pin-assignment mask is a normal steady-state system condition (docked laptop, DP-source accessory), not the attack action itself.\nAC:L - No race, no unpredictable memory state is required \u2014 the attacker simply reads the world-readable attribute and can repeat the read arbitrarily many times to groom the kmalloc-cg-4k slab and place a chosen neighbor before the seq_file buffer. The triggering condition (`get_current_pin_assignments()` returning 0) is deterministic for the attached partner and was hit by real production hardware.\nPR:L - The attribute is created with `DEVICE_ATTR_RW` (mode 0644) and the affected versions have no `is_visible` callback, so any unprivileged local account can read it with no capability, namespace, or group membership required.\nUI:N - Exploitation needs only the attacker\u0027s own `read()` syscall against a persistently present sysfs file; no victim must open, mount, or configure anything. On ChromeOS/Android the same read is additionally performed automatically by system daemons on partner registration.\nS:U - The corruption is kernel heap memory damaged by kernel code, confined to the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The write corrupts the final byte of an adjacent, attacker-groomable 4K slab object; overwriting a length, count, or index field in a neighboring structure converts this into out-of-bounds reads and kernel memory disclosure. Per kernel scoring guidance, heap memory corruption leveragable for information disclosure is scored High.\nI:H - This is a genuine heap out-of-bounds write (`buf[-1] = \u0027\\n\u0027`) into a neighboring slab allocation the attacker can select via heap grooming; single-byte heap overflows of this class have historically been escalated to arbitrary write and privilege escalation. Out-of-bounds writes are scored High.\nA:H - The originating report is a kernel fault \u2014 an arm64 MTE tag-check fault taken in `pin_assignment_show()` leading to an oops \u2014 and KASAN builds panic on the same access. On production kernels the silent corruption of an adjacent 4K slab object causes crashes, and the trigger can be repeated indefinitely by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:53.517Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff466f77d0a56719979c4234abd412abd98eae8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc0e18f95c88435bd8a1ceb540243cd7fbcd9781"
        },
        {
          "url": "https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/54ee23e4ab263a495ace1eed43d3883212ece17f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8f28269dd4bf9b55c3fb376ae31512730a96fce"
        }
      ],
      "title": "usb: typec: altmodes/displayport: fix pin_assignment_show",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54186",
    "datePublished": "2025-12-30T12:08:55.882Z",
    "dateReserved": "2025-12-30T12:06:44.497Z",
    "dateUpdated": "2026-08-05T09:17:53.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.