Linux Kernel up to 6.7.2 AMD Display dm_execute_dmub_cmd deadlock

Summaryinfo

A vulnerability identified as critical has been detected in Linux Kernel up to 6.7.2. Impacted is the function dm_execute_dmub_cmd of the component AMD Display. This manipulation causes deadlock. This vulnerability is handled as CVE-2023-52485. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.7.2 (Operating System) and classified as critical. Affected by this vulnerability is the function dm_execute_dmub_cmd of the component AMD Display. The manipulation with an unknown input leads to a deadlock vulnerability. The CWE definition for the vulnerability is CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before sending a command [Why] We can hang in place trying to send commands when the DMCUB isn't powered on. [How] For functions that execute within a DC context or DC lock we can wrap the direct calls to dm_execute_dmub_cmd/list with code that exits idle power optimizations and reallows once we're done with the command submission on success. For DM direct submissions the DM will need to manage the enter/exit sequencing manually. We cannot invoke a DMCUB command directly within the DM execution helper or we can deadlock.

The weakness was released 02/29/2024. It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2023-52485 since 02/20/2024. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.7.3 or 6.8-rc1 eliminates this vulnerability. Applying the patch 303197775a97/8892780834ae is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.7.0
• 6.7.1
• 6.7.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion