CVE-2023-53816 (GCVE-0-2023-53816)

Vulnerability from cvelistv5 – Published: 2025-12-09 00:01 – Updated: 2026-08-05 09:16
VLAI
Title
drm/amdkfd: fix potential kgd_mem UAFs
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix potential kgd_mem UAFs kgd_mem pointers returned by kfd_process_device_translate_handle are only guaranteed to be valid while p->mutex is held. As soon as the mutex is unlocked, another thread can free the BO.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 5045360f3bb62ccd4f87202e33489f71f8bbc3fc (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 5ca14fb5552ac13a2402d306c0bd2379a71610ff (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 9da050b0d9e04439d225a2ec3044af70cdfb3933 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 6.1.23 , ≤ 6.1.* (semver)
Unaffected: 6.2.10 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5045360f3bb62ccd4f87202e33489f71f8bbc3fc",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "5ca14fb5552ac13a2402d306c0bd2379a71610ff",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "9da050b0d9e04439d225a2ec3044af70cdfb3933",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.23",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.10",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix potential kgd_mem UAFs\n\nkgd_mem pointers returned by kfd_process_device_translate_handle are\nonly guaranteed to be valid while p-\u003emutex is held. As soon as the mutex\nis unlocked, another thread can free the BO."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through ioctls (AMDKFD_IOC_MAP_MEMORY_TO_GPU / UNMAP_MEMORY_FROM_GPU raced against FREE_MEMORY_OF_GPU) on the /dev/kfd character device, requiring local access to the system. There is no network or remote-peer input path into kfd_chardev.c.\nAC:L - The attacker controls both sides of the race entirely \u2014 two threads of their own process issuing concurrent ioctls \u2014 and can set the user-supplied args-\u003en_success equal to n_devices to skip the mapping loop so the concurrent free is not rejected with -EBUSY. The window is further made near-deterministic because the victim thread blocks on mutex_lock(\u0026mem-\u003elock) which the freeing thread holds, so it is woken onto memory that has already been mutex_destroy()\u0027d and kfree()\u0027d.\nPR:L - The map/unmap/free memory ioctls are defined with flags 0 \u2014 no capability check whatsoever; the only requirement is an open fd on /dev/kfd, which distro/ROCm udev rules grant to ordinary local users (mode 0666, render/video group, or uaccess for the seat user) on any AMD GPU workstation or GPU-compute node. No root, CAP_SYS_ADMIN, or CAP_CHECKPOINT_RESTORE is needed.\nUI:N - The attacker\u0027s own process performs all steps (allocate BO, then race map/unmap against free) with no action by any other user. No victim interaction is involved.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed. Standard local kernel privilege escalation stays Unchanged.\nC:H - The freed kgd_mem lives in a generic kmalloc cache and can be resprayed with attacker-controlled data, after which amdgpu_sync_clone() walks mem-\u003esync.fences and dereferences attacker-supplied pointers, giving an arbitrary kernel-memory read primitive and, via full control-flow hijack, disclosure of all kernel memory.\nI:H - The UAF yields writes into the freed slab (mutex_lock owner field, dma_fence_get refcount increments at attacker-chosen addresses) and an indirect call through a forged dma_fence_ops-\u003esignaled/-\u003ewait pointer, which is a control-flow hijack primitive enabling arbitrary kernel code execution and privilege escalation.\nA:H - Even without successful exploitation, operating on a kfree()\u0027d object with a mutex_destroy()\u0027d lock and walking its stale fence hashtable reliably produces kernel oopses/panics, and the attacker can trigger it repeatedly at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:10.458Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5045360f3bb62ccd4f87202e33489f71f8bbc3fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ca14fb5552ac13a2402d306c0bd2379a71610ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/9da050b0d9e04439d225a2ec3044af70cdfb3933"
        }
      ],
      "title": "drm/amdkfd: fix potential kgd_mem UAFs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53816",
    "datePublished": "2025-12-09T00:01:14.166Z",
    "dateReserved": "2025-12-08T23:58:35.277Z",
    "dateUpdated": "2026-08-05T09:16:10.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53816",
      "date": "2026-09-22",
      "epss": "0.00141",
      "percentile": "0.03785"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5045360f3bb62ccd4f87202e33489f71f8bbc3fc",
                    "status": "affected",
                    "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5ca14fb5552ac13a2402d306c0bd2379a71610ff",
                    "status": "affected",
                    "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9da050b0d9e04439d225a2ec3044af70cdfb3933",
                    "status": "affected",
                    "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix potential kgd_mem UAFs\n\nkgd_mem pointers returned by kfd_process_device_translate_handle are\nonly guaranteed to be valid while p-\u003emutex is held. As soon as the mutex\nis unlocked, another thread can free the BO."
          }
        ],
        "id": "CVE-2023-53816",
        "lastModified": "2026-08-04T10:19:22.453",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-09T01:16:53.840",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5045360f3bb62ccd4f87202e33489f71f8bbc3fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5ca14fb5552ac13a2402d306c0bd2379a71610ff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9da050b0d9e04439d225a2ec3044af70cdfb3933"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:16:03+00:00",
      "cve": "CVE-2023-53816",
      "id": "CVE-2023-53816",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdkfd: fix potential kgd_mem UAFs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53816.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:45:59Z",
      "cve": "CVE-2023-53816",
      "id": "CVE-2023-53816",
      "initial_release_date": "2025-12-10T00:35:38Z",
      "product_status:known_affected": "541",
      "product_status:known_not_affected": "265",
      "product_status:recommended": "159",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53816",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53816.json",
      "version": "31"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.