GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52662 (GCVE-0-2023-52662)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:41 – Updated: 2026-08-05 09:10
VLAI
Title
drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node When ida_alloc_max fails, resources allocated before should be freed, including *res allocated by kmalloc and ttm_resource_init.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-17 17:16 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732 , < 03b1072616a8f7d6e8594f643b416a9467c83fbf (git)
Affected: d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732 , < 40624af6674745e174c754a20d7c53c250e65e7a (git)
Affected: d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732 , < 83e0f220d1e992fa074157fcf14945bf170ffbc5 (git)
Affected: d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732 , < 6fc6233f6db1579b69b54b44571f1a7fde8186e6 (git)
Affected: d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732 , < d1e546ab91c670e536a274a75481034ab7534876 (git)
Affected: d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732 , < 89709105a6091948ffb6ec2427954cbfe45358ce (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.153 , ≤ 5.15.* (semver)
Unaffected: 6.1.83 , ≤ 6.1.* (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:16:26.923288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:27.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.236Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03b1072616a8f7d6e8594f643b416a9467c83fbf",
              "status": "affected",
              "version": "d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732",
              "versionType": "git"
            },
            {
              "lessThan": "40624af6674745e174c754a20d7c53c250e65e7a",
              "status": "affected",
              "version": "d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732",
              "versionType": "git"
            },
            {
              "lessThan": "83e0f220d1e992fa074157fcf14945bf170ffbc5",
              "status": "affected",
              "version": "d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732",
              "versionType": "git"
            },
            {
              "lessThan": "6fc6233f6db1579b69b54b44571f1a7fde8186e6",
              "status": "affected",
              "version": "d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732",
              "versionType": "git"
            },
            {
              "lessThan": "d1e546ab91c670e536a274a75481034ab7534876",
              "status": "affected",
              "version": "d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732",
              "versionType": "git"
            },
            {
              "lessThan": "89709105a6091948ffb6ec2427954cbfe45358ce",
              "status": "affected",
              "version": "d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node\n\nWhen ida_alloc_max fails, resources allocated before should be freed,\nincluding *res allocated by kmalloc and ttm_resource_init."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable GMR/MOB ID allocator is reached only via local DRM ioctls on the vmwgfx device (e.g. DRM_VMW_GB_SURFACE_CREATE / surface validate into VMW_PL_MOB), not via network packet processing.\nAC:L - An attacker can reliably exhaust the finite MOB/GMR ID space (~53K IDs) with repeated small surface/buffer allocations, after which each failed ida_alloc_max path leaks an LRU-linked resource under full attacker control.\nPR:L - The triggering ioctls are marked DRM_RENDER_ALLOW and are usable by an unprivileged local user with access to the DRM render node (/dev/dri/renderD*), without CAP_SYS_ADMIN or DRM master.\nUI:N - Exploitation requires only the attacker\u0027s own open/ioctl sequence against the render node; no action by another user is needed.\nS:U - Impact is confined to the guest kernel\u0027s TTM/DRM authority (memory leak and UAF in the same kernel); this does not cross a VM/host or other security boundary by itself.\nC:H - Skipping ttm_resource_fini leaves an orphaned ttm_resource on the manager LRU with a raw pointer to the BO; after the BO is freed, eviction/LRU walks (ttm_mem_evict_first) dereference the dangling res-\u003ebo, yielding a UAF that can be leveraged for arbitrary read.\nI:H - The same orphaned-LRU UAF against a freed BO is exploitable for heap reuse and write/control-flow hijacking primitives once the attacker triggers eviction after destroying the referenced buffer object.\nA:H - The UAF on LRU walk can oops/panic the kernel, and the unbounded per-failure leak of ttm_resource objects after ID exhaustion can also drive the system to OOM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:54.337Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876"
        },
        {
          "url": "https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce"
        }
      ],
      "title": "drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52662",
    "datePublished": "2024-05-17T13:41:02.183Z",
    "dateReserved": "2024-03-07T14:49:46.885Z",
    "dateUpdated": "2026-08-05T09:10:54.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52662",
      "date": "2026-09-16",
      "epss": "0.00239",
      "percentile": "0.15151"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.14\", \"versionEndExcluding\": \"5.15.153\", \"matchCriteriaId\": \"D811A71A-BD96-4E48-ABE1-315AD51DCB5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.83\", \"matchCriteriaId\": \"121A07F6-F505-4C47-86BF-9BB6CC7B6C19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.23\", \"matchCriteriaId\": \"E00814DC-0BA7-431A-9926-80FEB4A96C68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.11\", \"matchCriteriaId\": \"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.8.2\", \"matchCriteriaId\": \"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node\\n\\nWhen ida_alloc_max fails, resources allocated before should be freed,\\nincluding *res allocated by kmalloc and ttm_resource_init.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/vmwgfx: soluciona un memleak en vmw_gmrid_man_get_node Cuando falla ida_alloc_max, se deben liberar los recursos asignados anteriormente, incluido *res asignado por kmalloc y ttm_resource_init.\"}]",
      "id": "CVE-2023-52662",
      "lastModified": "2025-01-14T14:55:24.477",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-17T14:15:08.373",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2025-01-15T00:00:00.000Z",
      "cve": "CVE-2023-52662",
      "id": "msrc_CVE-2023-52662",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2023-52662.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52662\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:08.373\",\"lastModified\":\"2026-08-04T10:18:36.773\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node\\n\\nWhen ida_alloc_max fails, resources allocated before should be freed,\\nincluding *res allocated by kmalloc and ttm_resource_init.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/vmwgfx: soluciona un memleak en vmw_gmrid_man_get_node Cuando falla ida_alloc_max, se deben liberar los recursos asignados anteriormente, incluido *res asignado por kmalloc y ttm_resource_init.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\",\"lessThan\":\"03b1072616a8f7d6e8594f643b416a9467c83fbf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\",\"lessThan\":\"40624af6674745e174c754a20d7c53c250e65e7a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\",\"lessThan\":\"83e0f220d1e992fa074157fcf14945bf170ffbc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\",\"lessThan\":\"6fc6233f6db1579b69b54b44571f1a7fde8186e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\",\"lessThan\":\"d1e546ab91c670e536a274a75481034ab7534876\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\",\"lessThan\":\"89709105a6091948ffb6ec2427954cbfe45358ce\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.153\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.83\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.23\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.2\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-17T17:16:26.923288Z\",\"id\":\"CVE-2023-52662\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.153\",\"matchCriteriaId\":\"D811A71A-BD96-4E48-ABE1-315AD51DCB5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.83\",\"matchCriteriaId\":\"121A07F6-F505-4C47-86BF-9BB6CC7B6C19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.23\",\"matchCriteriaId\":\"E00814DC-0BA7-431A-9926-80FEB4A96C68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:57:19+00:00",
      "cve": "CVE-2023-52662",
      "id": "CVE-2023-52662",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52662.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:32:31Z",
      "cve": "CVE-2023-52662",
      "id": "CVE-2023-52662",
      "initial_release_date": "2024-05-18T02:48:47Z",
      "product_status:known_affected": "315",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "690",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52662",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52662.json",
      "version": "96"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:21.236Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52662\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T17:16:26.923288Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.643Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable GMR/MOB ID allocator is reached only via local DRM ioctls on the vmwgfx device (e.g. DRM_VMW_GB_SURFACE_CREATE / surface validate into VMW_PL_MOB), not via network packet processing.\\nAC:L - An attacker can reliably exhaust the finite MOB/GMR ID space (~53K IDs) with repeated small surface/buffer allocations, after which each failed ida_alloc_max path leaks an LRU-linked resource under full attacker control.\\nPR:L - The triggering ioctls are marked DRM_RENDER_ALLOW and are usable by an unprivileged local user with access to the DRM render node (/dev/dri/renderD*), without CAP_SYS_ADMIN or DRM master.\\nUI:N - Exploitation requires only the attacker\u0027s own open/ioctl sequence against the render node; no action by another user is needed.\\nS:U - Impact is confined to the guest kernel\u0027s TTM/DRM authority (memory leak and UAF in the same kernel); this does not cross a VM/host or other security boundary by itself.\\nC:H - Skipping ttm_resource_fini leaves an orphaned ttm_resource on the manager LRU with a raw pointer to the BO; after the BO is freed, eviction/LRU walks (ttm_mem_evict_first) dereference the dangling res-\u003ebo, yielding a UAF that can be leveraged for arbitrary read.\\nI:H - The same orphaned-LRU UAF against a freed BO is exploitable for heap reuse and write/control-flow hijacking primitives once the attacker triggers eviction after destroying the referenced buffer object.\\nA:H - The UAF on LRU walk can oops/panic the kernel, and the unbounded per-failure leak of ttm_resource objects after ID exhaustion can also drive the system to OOM.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\", \"lessThan\": \"03b1072616a8f7d6e8594f643b416a9467c83fbf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\", \"lessThan\": \"40624af6674745e174c754a20d7c53c250e65e7a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\", \"lessThan\": \"83e0f220d1e992fa074157fcf14945bf170ffbc5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\", \"lessThan\": \"6fc6233f6db1579b69b54b44571f1a7fde8186e6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\", \"lessThan\": \"d1e546ab91c670e536a274a75481034ab7534876\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d3bcb4b02fe977d6b7a82dbb6288e9223b5b6732\", \"lessThan\": \"89709105a6091948ffb6ec2427954cbfe45358ce\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.153\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf\"}, {\"url\": \"https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a\"}, {\"url\": \"https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5\"}, {\"url\": \"https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6\"}, {\"url\": \"https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876\"}, {\"url\": \"https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node\\n\\nWhen ida_alloc_max fails, resources allocated before should be freed,\\nincluding *res allocated by kmalloc and ttm_resource_init.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.153\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.83\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.23\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:10:54.337Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52662\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:10:54.337Z\", \"dateReserved\": \"2024-03-07T14:49:46.885Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:41:02.183Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.