GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54186 (GCVE-0-2023-54186)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:08 – Updated: 2026-08-05 09:17
VLAI
Title
usb: typec: altmodes/displayport: fix pin_assignment_show
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < 0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2 (git)
Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < 4f9c0a7c272626cb6716ffc7800e8c73260cdce6 (git)
Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < ff466f77d0a56719979c4234abd412abd98eae8f (git)
Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < fc0e18f95c88435bd8a1ceb540243cd7fbcd9781 (git)
Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < 08bd1be1c716fd50a7df48f82dcbc59a103082b5 (git)
Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < 54ee23e4ab263a495ace1eed43d3883212ece17f (git)
Affected: 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 , < d8f28269dd4bf9b55c3fb376ae31512730a96fce (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 4.19.284 , ≤ 4.19.* (semver)
Unaffected: 5.4.244 , ≤ 5.4.* (semver)
Unaffected: 5.10.181 , ≤ 5.10.* (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/altmodes/displayport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "4f9c0a7c272626cb6716ffc7800e8c73260cdce6",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "ff466f77d0a56719979c4234abd412abd98eae8f",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "fc0e18f95c88435bd8a1ceb540243cd7fbcd9781",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "08bd1be1c716fd50a7df48f82dcbc59a103082b5",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "54ee23e4ab263a495ace1eed43d3883212ece17f",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            },
            {
              "lessThan": "d8f28269dd4bf9b55c3fb376ae31512730a96fce",
              "status": "affected",
              "version": "0e3bb7d6894d9b6e67d6382bb03a46a1dc989588",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/altmodes/displayport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.284",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.244",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: fix pin_assignment_show\n\nThis patch fixes negative indexing of buf array in pin_assignment_show\nwhen get_current_pin_assignments returns 0 i.e. no compatible pin\nassignments are found.\n\nBUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c\n...\nCall trace:\ndump_backtrace+0x110/0x204\ndump_stack_lvl+0x84/0xbc\nprint_report+0x358/0x974\nkasan_report+0x9c/0xfc\n__do_kernel_fault+0xd4/0x2d4\ndo_bad_area+0x48/0x168\ndo_tag_check_fault+0x24/0x38\ndo_mem_abort+0x6c/0x14c\nel1_abort+0x44/0x68\nel1h_64_sync_handler+0x64/0xa4\nel1h_64_sync+0x78/0x7c\npin_assignment_show+0x26c/0x33c\ndev_attr_show+0x50/0xc0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds write executes inside a sysfs `show` handler invoked by an ordinary local `read(2)` on `/sys/class/typec/port*-partner/*/displayport/pin_assignment`. The USB-C DisplayPort partner whose VDO produces a zero pin-assignment mask is a normal steady-state system condition (docked laptop, DP-source accessory), not the attack action itself.\nAC:L - No race, no unpredictable memory state is required \u2014 the attacker simply reads the world-readable attribute and can repeat the read arbitrarily many times to groom the kmalloc-cg-4k slab and place a chosen neighbor before the seq_file buffer. The triggering condition (`get_current_pin_assignments()` returning 0) is deterministic for the attached partner and was hit by real production hardware.\nPR:L - The attribute is created with `DEVICE_ATTR_RW` (mode 0644) and the affected versions have no `is_visible` callback, so any unprivileged local account can read it with no capability, namespace, or group membership required.\nUI:N - Exploitation needs only the attacker\u0027s own `read()` syscall against a persistently present sysfs file; no victim must open, mount, or configure anything. On ChromeOS/Android the same read is additionally performed automatically by system daemons on partner registration.\nS:U - The corruption is kernel heap memory damaged by kernel code, confined to the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The write corrupts the final byte of an adjacent, attacker-groomable 4K slab object; overwriting a length, count, or index field in a neighboring structure converts this into out-of-bounds reads and kernel memory disclosure. Per kernel scoring guidance, heap memory corruption leveragable for information disclosure is scored High.\nI:H - This is a genuine heap out-of-bounds write (`buf[-1] = \u0027\\n\u0027`) into a neighboring slab allocation the attacker can select via heap grooming; single-byte heap overflows of this class have historically been escalated to arbitrary write and privilege escalation. Out-of-bounds writes are scored High.\nA:H - The originating report is a kernel fault \u2014 an arm64 MTE tag-check fault taken in `pin_assignment_show()` leading to an oops \u2014 and KASAN builds panic on the same access. On production kernels the silent corruption of an adjacent 4K slab object causes crashes, and the trigger can be repeated indefinitely by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:53.517Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff466f77d0a56719979c4234abd412abd98eae8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc0e18f95c88435bd8a1ceb540243cd7fbcd9781"
        },
        {
          "url": "https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/54ee23e4ab263a495ace1eed43d3883212ece17f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8f28269dd4bf9b55c3fb376ae31512730a96fce"
        }
      ],
      "title": "usb: typec: altmodes/displayport: fix pin_assignment_show",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54186",
    "datePublished": "2025-12-30T12:08:55.882Z",
    "dateReserved": "2025-12-30T12:06:44.497Z",
    "dateUpdated": "2026-08-05T09:17:53.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54186",
      "date": "2026-09-15",
      "epss": "0.00147",
      "percentile": "0.04281"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54186\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:06.570\",\"lastModified\":\"2026-08-04T11:16:35.693\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: altmodes/displayport: fix pin_assignment_show\\n\\nThis patch fixes negative indexing of buf array in pin_assignment_show\\nwhen get_current_pin_assignments returns 0 i.e. no compatible pin\\nassignments are found.\\n\\nBUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c\\n...\\nCall trace:\\ndump_backtrace+0x110/0x204\\ndump_stack_lvl+0x84/0xbc\\nprint_report+0x358/0x974\\nkasan_report+0x9c/0xfc\\n__do_kernel_fault+0xd4/0x2d4\\ndo_bad_area+0x48/0x168\\ndo_tag_check_fault+0x24/0x38\\ndo_mem_abort+0x6c/0x14c\\nel1_abort+0x44/0x68\\nel1h_64_sync_handler+0x64/0xa4\\nel1h_64_sync+0x78/0x7c\\npin_assignment_show+0x26c/0x33c\\ndev_attr_show+0x50/0xc0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/typec/altmodes/displayport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"4f9c0a7c272626cb6716ffc7800e8c73260cdce6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"ff466f77d0a56719979c4234abd412abd98eae8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"fc0e18f95c88435bd8a1ceb540243cd7fbcd9781\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"08bd1be1c716fd50a7df48f82dcbc59a103082b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"54ee23e4ab263a495ace1eed43d3883212ece17f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588\",\"lessThan\":\"d8f28269dd4bf9b55c3fb376ae31512730a96fce\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/typec/altmodes/displayport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.284\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.244\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.181\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.113\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.30\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.4\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54ee23e4ab263a495ace1eed43d3883212ece17f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d8f28269dd4bf9b55c3fb376ae31512730a96fce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc0e18f95c88435bd8a1ceb540243cd7fbcd9781\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff466f77d0a56719979c4234abd412abd98eae8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:53:45+00:00",
      "cve": "CVE-2023-54186",
      "id": "CVE-2023-54186",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "399",
      "product_status:known_affected": "66",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: typec: altmodes/displayport: fix pin_assignment_show",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54186.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:46:31Z",
      "cve": "CVE-2023-54186",
      "id": "CVE-2023-54186",
      "initial_release_date": "2025-12-31T00:28:59Z",
      "product_status:known_affected": "460",
      "product_status:known_not_affected": "268",
      "product_status:recommended": "268",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54186",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54186.json",
      "version": "22"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.