Linux Kernel up to 6.5.12/6.6.2 AMD array index

Summaryinfo

A vulnerability classified as problematic was found in Linux Kernel up to 6.5.12/6.6.2. This affects an unknown part of the component AMD. The manipulation results in array index. This vulnerability was named CVE-2023-52812. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 6.5.12/6.6.2. Affected is an unknown function of the component AMD. The manipulation with an unknown input leads to a array index vulnerability. CWE is classifying the issue as CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/amd: check num of link levels when update pcie param In SR-IOV environment, the value of pcie_table->num_of_link_levels will be 0, and num_of_levels - 1 will cause array index out of bounds

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2023-52812 since 05/21/2024. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/30/2024).

The vulnerability scanner Nessus provides a plugin with the ID 211777 (Debian dsa-5818 : affs-modules-6.1.0-21-4kc-malta-di - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.5.13 or 6.6.3 eliminates this vulnerability. Applying the patch 5b4574b663d0/09f617219fe9/406e8845356d is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (211777). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4
• 6.5.5
• 6.5.6
• 6.5.7
• 6.5.8
• 6.5.9
• 6.5.10
• 6.5.11
• 6.5.12
• 6.6.0
• 6.6.1
• 6.6.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion