{"id":"CVE-2023-53753","state":"PUBLISHED","title":"drm/amd/display: fix mapping to non-allocated address","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix mapping to non-allocated address\n\n[Why]\nThere is an issue mapping non-allocated location of memory.\nIt would allocate gpio registers from an array out of bounds.\n\n[How]\nPatch correct numbers of bounds for using.","publishedAt":"2025-12-08T01:19:13.743Z","updatedAt":"2026-10-15T21:41:35.356Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"8ce8a443ddd9002861a4ee8a7e33a0c02717422f","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"24aaf6603600d6d1159973c809ea2737664b28c4","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"9190d4a263264eabf715f5fc1827da45e3fdc247","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c","drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c","drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c","drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.16","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2.3","status":"unaffected","lessThanOrEqual":"6.2.*","versionType":"semver"},{"version":"6.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c","drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c","drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c","drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"]}],"references":["https://git.kernel.org/stable/c/8ce8a443ddd9002861a4ee8a7e33a0c02717422f","https://git.kernel.org/stable/c/24aaf6603600d6d1159973c809ea2737664b28c4","https://git.kernel.org/stable/c/9190d4a263264eabf715f5fc1827da45e3fdc247"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53753.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53753","state":"PUBLISHED","datePublished":"2025-12-08T01:19:13.743Z","dateUpdated":"2026-10-15T21:41:35.356Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-08T01:18:04.279Z"},"containers":{"cna":{"title":"drm/amd/display: fix mapping to non-allocated address","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix mapping to non-allocated address\n\n[Why]\nThere is an issue mapping non-allocated location of memory.\nIt would allocate gpio registers from an array out of bounds.\n\n[How]\nPatch correct numbers of bounds for using."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"8ce8a443ddd9002861a4ee8a7e33a0c02717422f","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"24aaf6603600d6d1159973c809ea2737664b28c4","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"9190d4a263264eabf715f5fc1827da45e3fdc247","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c","drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c","drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c","drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.16","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2.3","status":"unaffected","lessThanOrEqual":"6.2.*","versionType":"semver"},{"version":"6.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c","drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c","drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c","drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/8ce8a443ddd9002861a4ee8a7e33a0c02717422f"},{"url":"https://git.kernel.org/stable/c/24aaf6603600d6d1159973c809ea2737664b28c4"},{"url":"https://git.kernel.org/stable/c/9190d4a263264eabf715f5fc1827da45e3fdc247"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The amdgpu/DC display stack is a local device driver; the out-of-bounds indexing is reached through driver initialization and DDC/I2C transactions driven by local DRM ioctls on /dev/dri/card* (forced connector probe → drm_get_edid → dc_submit_i2c → dal_ddc_open → define_ddc_registers). There is no network-facing path to this code.\nAC:L - On an affected DCN2/DCN3/DCN3.2 board whose VBIOS maps a DDC/OEM-I2C line to the DC_GPIO_DDCVGA_A pad, en==GPIO_DDC_LINE_DDC_VGA is produced deterministically and the &ddc_shift[6]/&ddc_mask[6] overread happens on every gpio open — no race, no memory-layout grooming, and the attacker can repeat connector probes at will.\nPR:L - An unprivileged local user with a normal DRM/render node handle (video/render group, granted to the active logind session on desktops and to app processes on Android) can force connector detection and EDID/I2C traffic over the affected DDC line; no CAP_SYS_ADMIN or root is required.\nUI:N - The vulnerable path is entered by the driver itself at resource-pool/link init and by any programmatic connector probe or i2c transfer; no victim action such as plugging a monitor or opening a file is needed.\nS:U - The out-of-bounds access and its effects are entirely within the kernel's own security authority (kernel .rodata read plus GPU register programming by the same driver); no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds read of 40 bytes of kernel .rodata beyond the end of ddc_shift[]/ddc_mask[] — well past a \"few bytes\" — and the leaked adjacent kernel constants are consumed as bitfield descriptors whose effect on the GPIO/I2C register state is observable to the caller performing DDC transactions.\nI:H - The out-of-bounds-derived shift and mask values are fed directly into REG_SET/REG_UPDATE read-modify-write sequences against the GPU's DDC GPIO MASK register, so arbitrary unintended bits of live hardware control registers are overwritten with values the driver never validated.\nA:H - Misprogramming the DDC/I2C pad control bits wedges display detection and I2C on that line, and the global-out-of-bounds access plus the resulting out-of-range shift counts trigger KASAN/UBSAN reports that panic the kernel under panic_on_warn, which is standard on hardened and Android builds."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:15:50.057Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.2.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-53753","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:37:00.430443Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:41:35.356Z"}}]}}}